PT-2025-12243 · Lunary · Lunary

Published 2025-03-20 · Updated 2025-07-02 · CVE-2024-8764

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary versions be54057 and later

Description The issue allows users to upload and execute arbitrary regular expressions on the server, potentially leading to a Denial of Service (DoS) condition due to excessive resource consumption. This can block the server from processing other requests.

Recommendations For versions be54057 and later, consider disabling the execution of regular expressions on the server side until a patch is available to prevent potential Denial of Service (DoS) conditions. Restrict access to the server to minimize the risk of exploitation by limiting the ability of users to upload and execute arbitrary regular expressions.

Exploit

Fix

DoS

Improper Authorization

Weakness Enumeration

CWE-285

CWE-1333

Related Identifiers

CVE-2024-8764

Affected Products

Lunary

References · 6

• 🔥 https://huntr.com/bounties/088c04a1-d23a-47f2-9d7c-b84d7332868d · Exploit
• https://github.com/lunary-ai/lunary/commit/7ff89b0304d191534b924cf063f3648206d497fa · Patch
• https://osv.dev/vulnerability/CVE-2024-8764 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8764 · Security Note
• https://t.me/cvenotify/127491 · Telegram Post
• https://twitter.com/CVEnew/status/1902968887081308223 · Twitter Post