Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-9277

Date: September 27, 2024

A vulnerability classified as problematic was found in Langflow up to 1.0.18. Affected by this vulnerability is an unknown functionality of the file \src\backend\base\langflow\interface\utils.py of the component HTTP POST Request Handler. The manipulation of the argument remaining_text leads to inefficient regular expression complexity. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Language: Python

Severity Score

Related Resources (8)

https://nvd.nist.gov/vuln/detail/CVE-2024-9277
https://vuldb.com/?submit.410043
https://rumbling-slice-eb0.notion.site/Remote-Redos-in-https-github-com-langflow-ai-langflow-067159ced0d5494e91b06071384969c4?pvs=4
https://vuldb.com/?id.278659
https://github.com/langflow-ai/langflow
https://github.com/langflow-ai/langflow/blob/main/src/backend/base/langflow/interface/utils.py#L65
https://vuldb.com/?ctiid.278659
https://www.mend.io/vulnerability-database/CVE-2024-9277

Severity Score

Weakness Type (CWE)

Inefficient Regular Expression Complexity

CWE-1333

CVSS v3.1

Base Score:
Attack Vector (AV): ADJACENT_NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): LOW

CVSS v2

Base Score:
Access Vector (AV): ADJACENT
Access Complexity (AC): MEDIUM
Authentication (AU): SINGLE
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us