Description
This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With a large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service.
Recommendation
No fix is available yet. Followings are affected versions:
- >= 1.3.0, <= 1.8.3
References
Could your website be exposed too?
SmartScanner can check your website for angular vulnerable to super-linear runtime due to backtracking and gives you actionable findings to investigate.
Start a free scanRelated Issues
- angular-base64-upload vulnerable to unauthenticated remote code execution - CVE-2024-42640
- jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext - jose-node-esm-runtime - CVE-2024-28176
- jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext - jose-node-cjs-runtime - CVE-2024-28176
- Padding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtime - CVE-2021-29444
You might also like:
See something that needs correcting? Let us knowUpdated November 03, 2025