5.3

CVE-2024-4067: Regular Expression Denial of Service in micromatch

Analyzed
AliasesUBUNTU-CVE-2024-4067DEBIAN-CVE-2024-4067CGA-428m-pf5q-gw28
Published 13-05-2024Last modified 17-09-2024

Vulnerability summary

CVE-2024-4067 is a medium (CVSS 5.3) vulnerability in jonschlinkert micromatch. EPSS estimates a 1.43% chance of exploitation in the next 30 days, higher than 73% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
1.43%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 4 · Related 7
MGASA-2025-0194OPENSUSE-SU-2025:14663-1RHSA-2024:8906SUSE-SU-2024:3771-1CGA-6Q83-777J-GP5RCGA-7J2F-JXVW-GX52

Timeline

  1. 13-05-2024
    PublishedVulnerability first disclosed.
  2. 17-09-2024
    Last modifiedVulnerability information updated.

Description

The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

1.43%

Chance of exploitation in the next 30 days

Percentile

73%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.43% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (advisory.checkmarx.net)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard78 products
  • arangodb-3.11< 3.11.14.5-r25
  • arangodb-3.12< 3.12.11-r0
  • argo-workflows< 3.6.0-r1
  • argo-workflows-ui-3.7< 3.7.13-r2
  • gitlab-rails-ce-18.1All versions (No fix recorded)
Wolfi16 products
  • argo-workflows< 3.6.0-r1
  • argo-workflows-ui-3.7< 3.7.13-r2
  • katib-earlystopping< 0.19.0-r31
  • katib-suggestion-goptuna-compatAll versions (No fix recorded)
  • katib-suggestion-hyperband< 0.19.0-r31
Debian1 product
  • node-micromatchAll versions (No fix recorded) | < 4.0.7+~4.0.7-1
Jonschlinkert1 product
Micromatch1 product
Npm1 product
  • micromatch< 4.0.8
Ubuntu1 product
  • node-micromatchAll versions (No fix recorded)

7 vendors · 99 products

References

18 links
Show all 18 references