PT-2024-28409 · Async · Async

Dvasilen · Published 2024-07-01 · Updated 2025-07-19 · CVE-2024-39249

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Async versions 2.6.4 and earlier, Async versions 3.2.5 and earlier

Description The issue concerns a ReDoS (Regular Expression Denial of Service) vulnerability while parsing a function in the autoinject function. It is noted that the supplier disputes this vulnerability, citing that there is no realistic threat model because regular expressions are not used with untrusted input.

Recommendations For Async versions 2.6.4 and earlier, consider updating to a version later than 2.6.4 to resolve the issue. For Async versions 3.2.5 and earlier, consider updating to a version later than 3.2.5 to resolve the issue. As a temporary workaround, consider restricting the use of regular expressions with untrusted input in the autoinject function until a patch is available.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2024-39249

Affected Products

Async

References · 10

• 🔥❌ https://github.com/zunak/CVE-2024-39249 · Exploit, Deleted
• 🔥❌ https://github.com/zunak/CVE-2024-39249/issues/1 · Exploit, Deleted
• https://cve.org/CVERecord?id=CVE-2024-39249 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-39249 · Security Note
• https://osv.dev/vulnerability/CVE-2024-39249 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-39249 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-39249 · Vendor Advisory
• https://github.com/caolan/async/issues/1975#issuecomment-2204528153 · Note
• https://github.com/caolan/async/blob/v3.2.5/lib/autoInject.js#L41 · Note
• https://github.com/caolan/async/blob/v3.2.5/lib/autoInject.js#L6 · Note