« Volver al listado

CVE-2024-45813

Estado: AplazadaMedia (5.3)—

find-my-way is a fast, open source HTTP router, internally using a Radix Tree (aka compact Prefix Tree), supports route params, wildcards, and it's framework independent. A bad regular expression is generated any time one has two parameters within a single segment, when adding a `-` at the end, like `/:a-:b-`. This may cause a denial of service in some instances. Users are advised to update to find-my-way v8.2.2 or v9.0.1. or subsequent versions. There are no known workarounds for this issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Find-my-way — Find-my-wayAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-45813",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-45813",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-18T18:07:01.965848Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "delvedor",
          "product": "find-my-way",
          "versions": [
            {
              "status": "affected",
              "version": "< 8.2.2"
            },
            {
              "status": "affected",
              "version": "= 9.0.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-09-18T17:15:19.163",
  "references": [
    {
      "url": "https://blakeembrey.com/posts/2024-09-web-redos",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/delvedor/find-my-way/commit/5e9e0eb5d8d438e06a185d5e536a896572dd0440",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/delvedor/find-my-way/security/advisories/GHSA-rrr8-f88r-h8q6",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "find-my-way is a fast, open source HTTP router, internally using a Radix Tree (aka compact Prefix Tree), supports route params, wildcards, and it's framework independent. A bad regular expression is generated any time one has two parameters within a single segment, when adding a `-` at the end, like `/:a-:b-`. This may cause a denial of service in some instances. Users are advised to update to find-my-way v8.2.2 or v9.0.1. or subsequent versions. There are no known workarounds for this issue."
    },
    {
      "lang": "es",
      "value": "find-my-way es un enrutador HTTP rápido y de código abierto que utiliza internamente un árbol de base (también conocido como árbol de prefijos compacto), admite parámetros de ruta, comodines y es independiente del framework de trabajo. Se genera una expresión regular incorrecta cada vez que se tienen dos parámetros dentro de un solo segmento, al agregar un `-` al final, como `/:a-:b-`. Esto puede causar una denegación de servicio en algunos casos. Se recomienda a los usuarios que actualicen find-my-way a v8.2.2 o v9.0.1 o versiones posteriores. No se conocen workarounds para este problema."
    }
  ],
  "lastModified": "2026-06-17T07:54:51.987",
  "sourceIdentifier": "security-advisories@github.com"
}