Angular ng-srcset Vulnerable to Super-Linear Runtime Due to Backtracking

CVE-2024-21490

What is CVE-2024-21490?

A vulnerability exists in the AngularJS package, specifically affecting versions starting from 1.3.0, due to a flaw in the regular expression used to process the ng-srcset directive. This vulnerability allows for super-linear runtime behavior because of catastrophic backtracking when handling large and specially crafted input. As a result, an attacker could exploit this vulnerability to cause a denial of service condition. It is important to note that this package is at the end of its life (EOL) and will not receive any further updates to mitigate this issue. Users are strongly recommended to migrate to newer versions or alternatives like @angular/core to ensure security.

References