{"id":"CVE-2024-21490","state":"PUBLISHED","title":"This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vu","description":"This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. \r\r\r**Note:**\r\rThis package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).","publishedAt":"2024-02-10T05:00:01.641Z","updatedAt":"2026-07-06T15:25:05.623Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P","source":"snyk"},"assigner":"snyk","products":["n/a angular","n/a org.webjars.bower:angular","n/a org.webjars.npm:angular","n/a angularjs"],"affected":[{"vendor":"n/a","product":"angular","versions":[{"version":"1.3.0","status":"affected","lessThan":"*","versionType":"semver"}]},{"vendor":"n/a","product":"org.webjars.bower:angular","versions":[{"version":"1.3.0","status":"affected","lessThan":"*","versionType":"semver"}]},{"vendor":"n/a","product":"org.webjars.npm:angular","versions":[{"version":"1.3.0","status":"affected","lessThan":"*","versionType":"semver"}]},{"vendor":"n/a","product":"angularjs","versions":[{"version":"1.3.0","status":"affected","lessThan":"*","versionType":"semver"}]}],"references":["https://security.snyk.io/vuln/SNYK-JS-ANGULAR-6091113","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6241746","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6241747","https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJS-10771616","https://stackblitz.com/edit/angularjs-vulnerability-ng-srcset-redos","https://support.herodevs.com/hc/en-us/articles/25715686953485-CVE-2024-21490-AngularJS-Regular-Expression-Denial-of-Service-ReDoS","https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html"],"weaknesses":["CWE-1333"],"ingestedAt":"2026-10-29T20:06:59.846Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/21xxx/CVE-2024-21490.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-21490","state":"PUBLISHED","datePublished":"2024-02-10T05:00:01.641Z","dateUpdated":"2026-07-06T15:25:05.623Z","assignerShortName":"snyk","assignerOrgId":"bae035ff-b466-4ff4-94d0-fc9efd9e1730","dateReserved":"2023-12-22T12:33:20.118Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. \r\r\r**Note:**\r\rThis package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core)."}],"affected":[{"vendor":"n/a","product":"angular","versions":[{"version":"1.3.0","status":"affected","lessThan":"*","versionType":"semver"}]},{"vendor":"n/a","product":"org.webjars.bower:angular","versions":[{"version":"1.3.0","status":"affected","lessThan":"*","versionType":"semver"}]},{"vendor":"n/a","product":"org.webjars.npm:angular","versions":[{"version":"1.3.0","status":"affected","lessThan":"*","versionType":"semver"}]},{"vendor":"n/a","product":"angularjs","versions":[{"version":"1.3.0","status":"affected","lessThan":"*","versionType":"semver"}]}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-ANGULAR-6091113"},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6241746"},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6241747"},{"url":"https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJS-10771616"},{"url":"https://stackblitz.com/edit/angularjs-vulnerability-ng-srcset-redos"}],"metrics":[{"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","exploitCodeMaturity":"PROOF_OF_CONCEPT","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1333","description":"Regular Expression Denial of Service (ReDoS)","lang":"en"}]}],"providerMetadata":{"shortName":"snyk","orgId":"bae035ff-b466-4ff4-94d0-fc9efd9e1730","dateUpdated":"2026-07-06T15:25:05.623Z"},"credits":[{"value":"George Kalpakas","lang":"en"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-21490","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-02-12T19:24:29.584548Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-05T17:20:52.142Z"}},{"title":"CVE Program Container","references":[{"url":"https://security.snyk.io/vuln/SNYK-JS-ANGULAR-6091113","tags":["x_transferred"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6241746","tags":["x_transferred"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6241747","tags":["x_transferred"]},{"url":"https://stackblitz.com/edit/angularjs-vulnerability-ng-srcset-redos","tags":["x_transferred"]},{"url":"https://support.herodevs.com/hc/en-us/articles/25715686953485-CVE-2024-21490-AngularJS-Regular-Expression-Denial-of-Service-ReDoS","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T19:29:20.093Z"}}]}}}