CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2024-21490: This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to...
7.5
CVSS
Description
This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service.
**Note:**
This package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).
Classification
CVE ID: CVE-2024-21490
CVSS Base Severity: HIGH
CVSS Base Score: 7.5
Affected Products
Vendor: n/a
Product: angular
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.06% (probability of being exploited)
EPSS Percentile: 27.45% (scored less or equal to compared to others)
EPSS Date: 2025-02-14 (when was this score calculated)
References
https://security.snyk.io/vuln/SNYK-JS-ANGULAR-6091113https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6241746
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6241747
https://stackblitz.com/edit/angularjs-vulnerability-ng-srcset-redos