PT-2024-7923 · Braces+5 · Braces+5

Archanasharma3 · Published 2024-01-24 · Updated 2026-06-04 · CVE-2024-4068

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions braces versions prior to 3.0.3

Description The issue is related to uncontrolled resource consumption. If a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, causing the program to allocate heap memory without freeing it, eventually leading to a crash due to the JavaScript heap limit being reached.

Recommendations For versions prior to 3.0.3, update to version 3.0.3 or later to resolve the issue. As a temporary workaround, consider restricting input to prevent "imbalanced braces" from being sent to the lib/parse.js module until a patch is available.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-1050

CWE-400

Related Identifiers

ALT-PU-2025-9506

ALT-PU-2025-9551

AZL-42034

AZL-44020

AZL-44562

BDU:2024-09427

CVE-2024-4068

GHSA-GRV7-FG5C-XMJG

OPENSUSE-SU-2024:14257-1

OPENSUSE-SU-2024:14258-1

OPENSUSE-SU-2024_3771-1

OPENSUSE-SU-2025:14663-1

OPENSUSE-SU-2025_1326-1

RHSA-2024:8075

RHSA-2024:8076

RHSA-2024:8077

SUSE-SU-2024:3771-1

SUSE-SU-2025:01326-1

SUSE-SU-2025:1326-1

Affected Products

Alt Linux

Bitbucket

Debian

Red Os

Suse

Braces

References · 89

• https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff · Patch
• https://github.com/micromatch/braces/pull/40 · Patch
• https://github.com/micromatch/braces/pull/37 · Patch
• https://osv.dev/vulnerability/AZL-44562 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09427 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14258-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-4068 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-4068 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4068 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2024-4068 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4068 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-4068 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14257-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-4068 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14663-1 · Vendor Advisory