{"id":"CVE-2024-21490","aliases":["GHSA-4w4v-5hc9-xrr2"],"url":"https://o3.security/vulnerability/CVE-2024-21490","summary":"angular vulnerable to super-linear runtime due to backtracking","details":"This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. \r\r\r**Note:**\r\rThis package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).","published":"2024-02-10T05:15:08.650Z","modified":"2026-03-15T22:48:22.750777Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Maven","name":"org.webjars.npm:angular","fixedVersion":null},{"ecosystem":"Maven","name":"org.webjars.bower:angular","fixedVersion":null},{"ecosystem":"npm","name":"angular","fixedVersion":null}],"fix":null,"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html"},{"type":"ADVISORY","url":"https://security.snyk.io/vuln/SNYK-JS-ANGULAR-6091113"},{"type":"ADVISORY","url":"https://support.herodevs.com/hc/en-us/articles/25715686953485-CVE-2024-21490-AngularJS-Regular-Expression-Denial-of-Service-ReDoS"},{"type":"ADVISORY","url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6241746"},{"type":"ADVISORY","url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6241747"},{"type":"EVIDENCE","url":"https://stackblitz.com/edit/angularjs-vulnerability-ng-srcset-redos"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-03-15T22:48:22.750777Z"}}