ReDoS in kubeflow/kubeflow

CVE-2024-5552

What is CVE-2024-5552?

The vulnerability in Kubeflow allows for a Remote Regular Expression Denial of Service (ReDoS) attack due to inefficient regular expression handling in its email validation feature. An attacker can exploit this vulnerability remotely without requiring authentication, sending specially crafted input that leads to excessive CPU usage, ultimately causing resource exhaustion. This impacts the operational integrity of the system, leading to potential service disruptions. The vulnerability resides primarily in the centraldashboard-angular backend component of the latest version of Kubeflow.

References