{"id":"CVE-2024-4068","aliases":["AZL-42034","AZL-44020","AZL-44562","CLSA-2026-1771546208","CLSA-2026-1771805413","CLSA-2026-1776731778","CLSA-2026-1777509592","CLSA-2026-1780879899","DEBIAN-CVE-2024-4068","EUVD-2024-1632","GHSA-grv7-fg5c-xmjg","RHSA-2024:8075","RHSA-2024:8076","RHSA-2024:8077","ROOT-APP-NPM-CVE-2024-4068","SUSE-SU-2024:3771-1","SUSE-SU-2025:01326-1","SUSE-SU-2025:1326-1","UBUNTU-CVE-2024-4068","openSUSE-SU-2024:14257-1","openSUSE-SU-2024:14258-1","openSUSE-SU-2025:14663-1"],"status":"published","title":"Memory Exhaustion in braces","description":"The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01471,"percentile":0.73958,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1050","CWE-400"],"published":"2024-05-13T10:06:38Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"braces","fixed_in":["3.0.3"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"reaper","fixed_in":["3.1.1-9"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"braces","fixed_in":["2.3.2-tuxcare.1","1.8.5-tuxcare.1","0.1.5-tuxcare.1","2.3.1-tuxcare.1","3.0.2-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-braces","fixed_in":["3.0.3+~3.0.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-braces","fixed_in":["3.0.3+~3.0.4-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"braces","fixed_in":["3.0.2-aikido.2","2.3.2-aikido.2","3.0.2-aikido.3","2.3.2-aikido.3","3.0.3-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/braces","fixed_in":["3.0.2-root.io.1","2.3.2-root.io.1","3.0.2-root.io.2","2.3.2-root.io.2","3.0.2-root.io.3","2.3.2-root.io.3","3.0.3-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"reaper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-5"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.2-tuxcare.0"},{"fixed":"2.3.2-tuxcare.1"}]}],"versions":["2.3.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.5-tuxcare.0"},{"fixed":"1.8.5-tuxcare.1"}]}],"versions":["1.8.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.5-tuxcare.0"},{"fixed":"0.1.5-tuxcare.1"}]}],"versions":["0.1.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.1-tuxcare.0"},{"fixed":"2.3.1-tuxcare.1"}]}],"versions":["2.3.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.2-tuxcare.0"},{"fixed":"3.0.2-tuxcare.1"}]}],"versions":["3.0.2"]},{"source":"osv","ecosystem":"Debian:12","package":"node-braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.2+~3.0.1-1","3.0.3+~3.0.4-1","3.0.3+~3.0.5-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3+~3.0.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3+~3.0.4-1"}]}]},{"source":"osv","ecosystem":"npm","package":"braces","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-hal-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.24-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-hibernate-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.23-2.SP1_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-hibernate-validator-cdi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.23-2.SP1_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-insights-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-1.redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-ironjacamar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-ironjacamar-common-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-ironjacamar-common-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-ironjacamar-common-spi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-ironjacamar-core-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-ironjacamar-core-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-ironjacamar-deployers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-ironjacamar-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-ironjacamar-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-jboss-cert-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-1.redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-jboss-cert-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-1.redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-jboss-ejb-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.55-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-jboss-server-migration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-39.Final_redhat_00039.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-jboss-server-migration-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-39.Final_redhat_00039.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-jboss-server-migration-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-39.Final_redhat_00039.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-jbossws-cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.12-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-jsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.4-1.redhat_00003.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-undertow-jastow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.15-1.Final_redhat_00001.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-wildfly-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-wildfly-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-wildfly-javadocs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-37.redhat_00015.1.el7eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-hal-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.24-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-hibernate-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.23-2.SP1_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-hibernate-validator-cdi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.23-2.SP1_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-insights-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-1.redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-ironjacamar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-ironjacamar-common-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-ironjacamar-common-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-ironjacamar-common-spi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-ironjacamar-core-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-ironjacamar-core-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-ironjacamar-deployers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-ironjacamar-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-ironjacamar-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-jboss-cert-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-1.redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-jboss-ejb-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.55-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-jboss-server-migration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-39.Final_redhat_00039.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-jboss-server-migration-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-39.Final_redhat_00039.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-jboss-server-migration-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-39.Final_redhat_00039.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-jbossws-cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.12-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-jsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.4-1.redhat_00003.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-undertow-jastow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.15-1.Final_redhat_00001.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-wildfly-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-wildfly-java-jdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-wildfly-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-wildfly-javadocs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-37.redhat_00015.1.el8eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-hal-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.24-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-hibernate-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.23-2.SP1_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-hibernate-validator-cdi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.23-2.SP1_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-insights-java-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-1.redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-ironjacamar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-ironjacamar-common-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-ironjacamar-common-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-ironjacamar-common-spi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-ironjacamar-core-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-ironjacamar-core-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-ironjacamar-deployers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-ironjacamar-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-ironjacamar-validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.18-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-jboss-cert-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-1.redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-jboss-ejb-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.55-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-jboss-server-migration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-39.Final_redhat_00039.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-jboss-server-migration-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-39.Final_redhat_00039.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-jboss-server-migration-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.0-39.Final_redhat_00039.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-jbossws-cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.12-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-jsoup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.4-1.redhat_00003.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-undertow-jastow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.15-1.Final_redhat_00001.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-wildfly-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-wildfly-java-jdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-wildfly-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-wildfly-javadocs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4.19-1.GA_redhat_00002.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-xalan-j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-37.redhat_00015.1.el9eap"}]}],"bundled":5},{"source":"osv","ecosystem":"Root:npm","package":"braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-aikido.2"},{"fixed":"2.3.2-aikido.2"},{"fixed":"3.0.2-aikido.3"},{"fixed":"2.3.2-aikido.3"},{"fixed":"3.0.3-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-root.io.1"},{"fixed":"2.3.2-root.io.1"},{"fixed":"3.0.2-root.io.2"},{"fixed":"2.3.2-root.io.2"},{"fixed":"3.0.2-root.io.3"},{"fixed":"2.3.2-root.io.3"},{"fixed":"3.0.3-root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5-150600.3.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5-150600.3.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.2-1","2.0.2-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.2-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.2+~3.0.0-1","3.0.2+~3.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.2+~3.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.3+~3.0.4-1","3.0.3+~3.0.5-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.3+~3.0.5-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-braces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.3+~3.0.5-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"traefik","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"traefik2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.8-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.4.git142.862ef23-1.1"}]}],"bundled":27}],"products":[{"vendor":"jonschlinkert","product":"braces"},{"vendor":"micromatch","product":"braces"}],"references":[{"url":"https://github.com/micromatch/braces/issues/35","tags":["x_transferred","Issue Tracking","report","web","article"]},{"url":"https://devhub.checkmarx.com/cve-details/CVE-2024-4068/","tags":["x_transferred","Third Party Advisory","web","article","report"]},{"url":"https://github.com/micromatch/braces/pull/37","tags":["x_transferred","Exploit","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/micromatch/braces/pull/40","tags":["x_transferred","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff","tags":["x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4068","tags":["web","advisory"]},{"url":"https://devhub.checkmarx.com/cve-details/CVE-2024-4068","tags":["web"]},{"url":"https://github.com/micromatch/braces/blob/98414f9f1fabe021736e26836d8306d5de747e0d/lib/parse.js#L308","tags":["web","article","report"]},{"url":"https://github.com/advisories/GHSA-grv7-fg5c-xmjg"},{"url":"https://www.npmjs.com/package/micromatch","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4068.json","tags":["advisory"]},{"url":"https://github.com/micromatch/braces","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-4068","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:8075","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2108554","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2127078","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266921","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2278615","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2280600","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBEAP-27049","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27357","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27548","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27613","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27658","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27700","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27701","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27713","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27714","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27715","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27746","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-27747","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8075.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-34169","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-34169","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34169","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-36033","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-36033","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36033","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-51775","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-51775","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-51775","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-4029","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-4029","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4029","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x7g6-rwhc-g7mj","tags":["advisory"]},{"url":"https://github.com/wildfly/wildfly/pull/17914","tags":["article"]},{"url":"https://github.com/wildfly/wildfly/pull/17935","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-4068","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-4068","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2024:8076","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/JBEAP-27050","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8076.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:8077","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/JBEAP-27051","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8077.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243771-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1224295","tags":["report"]},{"url":"https://bugzilla.suse.com/1224366","tags":["report"]},{"url":"https://bugzilla.suse.com/1226967","tags":["report"]},{"url":"https://bugzilla.suse.com/1227248","tags":["report"]},{"url":"https://bugzilla.suse.com/1227252","tags":["report"]},{"url":"https://bugzilla.suse.com/1229423","tags":["report"]},{"url":"https://bugzilla.suse.com/1229861","tags":["report"]},{"url":"https://bugzilla.suse.com/1230928","tags":["report"]},{"url":"https://bugzilla.suse.com/1231564","tags":["report"]},{"url":"https://bugzilla.suse.com/1231684","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9014","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501326-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234840","tags":["report"]},{"url":"https://bugzilla.suse.com/1239308","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27152","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251326-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-4068","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6104","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55565","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-4068","title":"Memory Exhaustion in braces","description":"The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.","status":"published","published":"2024-05-13T10:06:38.152Z","modified":"2024-11-06T13:10:11.179Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-1050","CWE-400"],"updated_at":"2026-11-02T14:34:16.78507Z"}],"euvd":[{"id":"EUVD-2024-1632","description":"The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.","status":"published","published":"2024-05-13T10:06:38Z","modified":"2024-11-06T13:10:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:05:10.508802Z"}],"ghsa":[{"id":"GHSA-grv7-fg5c-xmjg","title":"Uncontrolled resource consumption in braces","description":"The NPM package `braces` fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.\n","status":"published","published":"2024-05-14T18:30:54Z","modified":"2024-07-05T21:25:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-1050"],"updated_at":"2026-11-02T14:37:56.530214Z"}],"nvd":[{"id":"CVE-2024-4068","description":"The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.","status":"published","published":"2024-05-14T15:42:48.66Z","modified":"2026-06-17T08:01:02.583Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1050","CWE-400"],"updated_at":"2026-11-02T14:09:58.124007Z"}],"osv":[{"id":"CVE-2024-4068","title":"Memory Exhaustion in braces","description":"The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.","status":"published","published":"2024-05-13T10:06:38.152Z","modified":"2026-10-28T02:30:39.145181392Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1050"],"updated_at":"2026-11-02T15:44:41.618074Z"},{"id":"DEBIAN-CVE-2024-4068","description":"The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.","status":"published","published":"2024-05-14T15:42:48.66Z","modified":"2026-11-02T12:02:37.833807565Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:43.156294Z"},{"id":"GHSA-grv7-fg5c-xmjg","title":"Uncontrolled resource consumption in braces","description":"The NPM package `braces` fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.\n","status":"published","published":"2024-05-14T18:30:54Z","modified":"2026-09-10T03:50:00.374713008Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1050","CWE-400"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"RHSA-2024:8075","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.19 Security update","status":"published","published":"2024-10-15T00:24:36Z","modified":"2026-10-17T10:04:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:8076","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.19 Security update","status":"published","published":"2024-10-15T00:24:06Z","modified":"2026-10-17T10:04:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:8077","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.19 Security update","status":"published","published":"2024-10-15T00:24:57Z","modified":"2026-10-17T10:04:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"UBUNTU-CVE-2024-4068","description":"The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.","status":"published","published":"2024-05-14T15:42:00Z","modified":"2026-10-17T12:57:23.703734324Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:54.69008Z"},{"id":"AZL-42034","title":"CVE-2024-4068 affecting package reaper for versions less than 3.1.1-9","description":"The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.","status":"published","published":"2024-05-14T15:42:48Z","modified":"2026-04-21T04:29:23.270224Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"AZL-44020","title":"CVE-2024-4068 affecting package nodejs-nodemon 2.0.3-4","description":"The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.","status":"published","published":"2024-05-14T15:42:48Z","modified":"2026-04-21T04:31:15.718869Z","updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-44562","title":"CVE-2024-4068 affecting package nodejs-nodemon 2.0.3-5","description":"The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.","status":"published","published":"2024-05-14T15:42:48Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"CLSA-2026-1771546208","title":"TuxCare security update for braces (1 CVE)","description":"TuxCare rebuilt braces to address 1 CVE. Fixed in 2.3.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-10-15T09:47:46.160024736Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1771805413","title":"TuxCare security update for braces (1 CVE)","description":"TuxCare rebuilt braces to address 1 CVE. Fixed in 1.8.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-10-15T09:47:46.33307552Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1776731778","title":"TuxCare security update for braces (1 CVE)","description":"TuxCare rebuilt braces to address 1 CVE. Fixed in 0.1.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:27Z","modified":"2026-10-15T09:47:02.818519811Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1777509592","title":"TuxCare security update for braces (1 CVE)","description":"TuxCare rebuilt braces to address 1 CVE. Fixed in 2.3.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-10-15T09:45:48.776728947Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1780879899","title":"TuxCare security update for braces (1 CVE)","description":"TuxCare rebuilt braces to address 1 CVE. Fixed in 3.0.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-15T09:47:50.368295002Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"openSUSE-SU-2024:14257-1","title":"traefik-3.1.2-1.1 on GA media","description":"These are all security issues fixed in the traefik-3.1.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-08-10T00:00:00Z","modified":"2025-05-07T18:16:10.382143Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14258-1","title":"traefik2-2.11.8-1.1 on GA media","description":"These are all security issues fixed in the traefik2-2.11.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-08-10T00:00:00Z","modified":"2026-02-04T02:19:48.403456Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2025:14663-1","title":"velociraptor-0.7.0.4.git142.862ef23-1.1 on GA media","description":"These are all security issues fixed in the velociraptor-0.7.0.4.git142.862ef23-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-17T00:00:00Z","modified":"2026-02-04T03:47:20.18775Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"ROOT-APP-NPM-CVE-2024-4068","title":"CVE-2024-4068 in braces - Patched by Root","description":"Root has patched CVE-2024-4068 in the braces package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-12T10:25:46Z","modified":"2026-10-12T11:15:03.493117489Z","updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"SUSE-SU-2024:3771-1","title":"Security update for pgadmin4","description":"This update for pgadmin4 fixes the following issues:\n\n- CVE-2024-38355: Fixed socket.io: unhandled 'error' event (bsc#1226967)\n- CVE-2024-38998: Fixed requirejs: prototype pollution via function config (bsc#1227248)\n- CVE-2024-38999: Fixed requirejs: prototype pollution via function s.contexts._.configure (bsc#1227252)\n- CVE-2024-39338: Fixed axios: server-side request forgery due to requests for path relative URLs being processed as protocol relative URLs in axios (bsc#1229423)\n- CVE-2024-4067: Fixed micromatch: vulnerable to Regular Expression Denial of Service (ReDoS) (bsc#1224366)\n- CVE-2024-4068: Fixed braces: fails to limit the number of characters it can handle, which could lead to Memory Exhaustion (bsc#1224295)\n- CVE-2024-43788: Fixed webpack: DOM clobbering gadget in AutoPublicPathRuntimeModule could lead to XSS (bsc#1229861)\n- CVE-2024-48948: Fixed elliptic: ECDSA signature verification error due to leading zero may reject legitimate transactions in elliptic (bsc#1231684)\n- CVE-2024-48949: Fixed elliptic: Missing Validation in Elliptic's EDDSA Signature Verification (bsc#1231564)\n- CVE-2024-9014: Fixed OAuth2 issue that could lead to information leak (bsc#1230928)\n","status":"published","published":"2024-10-29T12:55:34Z","modified":"2026-02-04T02:25:55.097314Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2025:01326-1","title":"Security update for pgadmin4","description":"This update for pgadmin4 fixes the following issues:\n\n- CVE-2025-27152: Fixed SSRF and creadential leakage due to requests sent to absolute URL even when baseURL is set (bsc#1239308)\n- CVE-2023-1907: Fixed an issue which could result in users being authenticated in another user's session if two users authenticate simultaneously via ldap (bsc#1234840)\n- CVE-2024-4068: Fixed a possible memory exhaustion (bsc#1224295)\n","status":"published","published":"2025-08-14T13:03:13Z","modified":"2026-03-23T04:46:16.058951Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:1326-1","title":"Security update for pgadmin4","description":"This update for pgadmin4 fixes the following issues:\n\n- CVE-2025-27152: Fixed SSRF and creadential leakage due to requests sent to absolute URL even when baseURL is set (bsc#1239308)\n- CVE-2023-1907: Fixed an issue which could result in users being authenticated in another user's session if two users authenticate simultaneously via ldap (bsc#1234840)\n- CVE-2024-4068: Fixed a possible memory exhaustion (bsc#1224295)\n","status":"published","published":"2025-04-16T08:37:10Z","modified":"2026-02-04T04:34:05.353677Z","updated_at":"2026-11-02T15:53:59.381172Z"}]}}