Regular Expression Denial of Service Vulnerability in Lunary by Lunary AI

CVE-2024-8789

What is CVE-2024-8789?

Lunary AI's Lunary application is susceptible to a Regular Expression Denial of Service (ReDoS) attack, allowing users to upload custom regular expressions for server-side execution. Certain regular expressions can lead to significant delays in server response time, as they exhibit exponential runtime complexity depending on the input size. Malicious users can exploit this flaw by submitting specially designed regular expressions, potentially causing the server to become unresponsive for extended periods.

References