ReDoS Vulnerability in Gaizhenbiao's Chuanhuchatgpt Product

CVE-2024-10955

What is CVE-2024-10955?

A Regular Expression Denial of Service (ReDoS) vulnerability has been identified in Gaizhenbiao's Chuanhuchatgpt product. The vulnerability arises from the use of an inefficient regex pattern r'<[^>]+>' for user input parsing. This pattern can exhibit significant performance degradation when processing specially crafted inputs, potentially leading to high CPU usage and an eventual Denial of Service (DoS) condition. An attacker can exploit this weakness by submitting a malicious JSON payload, which can cause the server to become unresponsive, affecting all users relying on the service.

References