ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord
CVE-2024-52798

path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x

CVSS 4.0 7.7 HIGHEUVD CVSS 4.0 7.7 CVSS 4.0 · [email protected] · Secondary 7.7 HIGHCVSS_V3 CVSS_V4 Publisher rating HIGHFixed by path-to-regexp 0.1.12KEV status unknown
Original advisory

cve-program · CVE-2024-52798

Published

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.

Read the publisher's advisory

euvd · EUVD-2024-3506

Published

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.

Read the publisher's advisory

nvd · CVE-2024-52798

Published

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.

Read the publisher's advisory

osv · GHSA-rhx6-c78j-4q9w

Published

### Impact The regular expression that is vulnerable to backtracking can be generated in versions before 0.1.12 of `path-to-regexp`, originally reported in CVE-2024-45296 ### Patches Upgrade to 0.1.12. ### Workarounds Avoid using two parameters within a single path segment, when the separator is not `.` (e.g. no `/:a-:b`). Alternatively, you can define the regex used for both parameters and ensure they do not overlap to allow backtracking. ### References - https://github.com/advisories/GHSA-9wv6-86v2-598j - https://blakeembrey.com/posts/2024-09-web-redos/

Read the publisher's advisory

Affected versions, risk and source history

Exploitation and risk

Source status

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

Which CVEs have scores here?

This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

cve-program · CVE-2024-52798

Published

path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.

Source published
5 Dec 2024 22:45:42 UTC
Source modified
24 Jan 2025 20:03:11 UTC
Saved here
23 Oct 2026 15:48:27 UTC
Source terms
CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 4.0 · 7.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

euvd · EUVD-2024-3506

Published

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can b…

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.

Additional publisher context

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Dec 5, 2024, 10:45:42 PM

dateUpdated: Jan 24, 2025, 8:03:11 PM

19 related source bulletins · separate from aliases

msrc_CVE-2024-52798: path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x

CVE-2024-52798

RHSA-2025:3368: Red Hat Security Advisory: RHOAI 2.16.0 - Red Hat OpenShift AI

CVE-2024-21538 · CVE-2024-45296 · CVE-2024-45338 · CVE-2024-45339 · CVE-2024-52798 · CVE-2024-55565 · CVE-2024-56171 · CVE-2024-56201 · CVE-2025-22150 · CVE-2025-24928 · CVE-2025-26791

RHSA-2025:8761: Red Hat Security Advisory: HawtIO 4.2.0 for Red Hat build of Apache Camel 4 Release and security update.

CVE-2024-12397 · CVE-2024-52798 · CVE-2024-57699 · CVE-2025-22866 · CVE-2025-24970

RHSA-2025:1051: Red Hat Security Advisory: Red Hat OpenShift Service Mesh Containers for 2.5.8

CVE-2024-45338 · CVE-2024-52798 · CVE-2024-55565

RHSA-2025:0876: Red Hat Security Advisory: OpenShift Container Platform 4.17.15 bug fix and security update

CVE-2024-9676 · CVE-2024-52798

RHBA-2025:0409: Red Hat Bug Fix Advisory: Red Hat Developer Hub 1.4.1 release.

CVE-2024-45338 · CVE-2024-52798 · CVE-2024-55565 · CVE-2024-56201 · CVE-2024-56326 · CVE-2024-56334

RHSA-2024:6122: Red Hat Security Advisory: OpenShift Container Platform 4.18.1 bug fix and security update

CVE-2023-44270 · CVE-2023-45288 · CVE-2024-3727 · CVE-2024-6104 · CVE-2024-6508 · CVE-2024-7387 · CVE-2024-9341 · CVE-2024-10963 · CVE-2024-12085 · CVE-2024-12698 · CVE-2024-21538 · CVE-2024-24786 · CVE-2024-39338 · CVE-2024-43803 · CVE-2024-45296 · CVE-2024-45338 · CVE-2024-45496 · CVE-2024-47211 · CVE-2024-48910 · CVE-2024-50311 · CVE-2024-50312 · CVE-2024-52798 · CVE-2024-53104 · CVE-2025-21613 · CVE-2025-21614

WID-SEC-W-2025-0264: HCL BigFix Server Automation: Schwachstelle ermöglicht Denial of Service

CVE-2024-52798

RHSA-2025:3374: Red Hat Security Advisory: Red Hat Developer Hub 1.5.1 release.

CVE-2024-45338 · CVE-2024-47068 · CVE-2024-52798 · CVE-2024-55565 · CVE-2024-56201 · CVE-2024-56326 · CVE-2024-56334 · CVE-2025-22150 · CVE-2025-27516 · CVE-2025-29774 · CVE-2025-29775

RHSA-2025:3397: Red Hat Security Advisory: RHOAI 2.16.0 - Red Hat OpenShift AI

CVE-2024-21538 · CVE-2024-45296 · CVE-2024-45338 · CVE-2024-45339 · CVE-2024-52798 · CVE-2024-55565 · CVE-2024-56171 · CVE-2024-56201 · CVE-2025-22150 · CVE-2025-24928 · CVE-2025-26791

RHSA-2025:0875: Red Hat Security Advisory: OpenShift Container Platform 4.17.15 security and extras update

CVE-2024-21538 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-45338 · CVE-2024-45590 · CVE-2024-48910 · CVE-2024-52798 · CVE-2024-55565 · CVE-2024-56201 · CVE-2024-56326

RHSA-2025:1249: Red Hat Security Advisory: updated discovery container images

CVE-2020-11023 · CVE-2023-44270 · CVE-2024-6485 · CVE-2024-8775 · CVE-2024-21536 · CVE-2024-21538 · CVE-2024-31228 · CVE-2024-31449 · CVE-2024-39338 · CVE-2024-41989 · CVE-2024-41991 · CVE-2024-42005 · CVE-2024-43788 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-45590 · CVE-2024-46981 · CVE-2024-52798 · CVE-2024-53907 · CVE-2024-55565 · CVE-2024-56201 · CVE-2024-56326 · CVE-2024-56374

WID-SEC-W-2025-0043: IBM QRadar SIEM (Log Source Management App): Mehrere Schwachstellen

CVE-2024-43788 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-47068 · CVE-2024-47875 · CVE-2024-21536 · CVE-2024-21538 · CVE-2024-33883 · CVE-2024-37890 · CVE-2024-4067 · CVE-2024-4068 · CVE-2024-45296 · CVE-2024-45590 · CVE-2024-48948 · CVE-2024-48949 · CVE-2024-52798 · CVE-2024-55565 · CVE-2024-45801 · CVE-2024-42459 · CVE-2024-42460 · CVE-2024-42461 · CVE-2024-47764

RHSA-2025:0783: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.16.6 Bug fix update

CVE-2024-45338 · CVE-2024-52798

RHSA-2025:1448: Red Hat Security Advisory: RHOAI 2.17.0 - Red Hat OpenShift AI

CVE-2024-21538 · CVE-2024-45337 · CVE-2024-45338 · CVE-2024-45339 · CVE-2024-49767 · CVE-2024-52798 · CVE-2024-55565

WID-SEC-W-2025-0504: HCL BigFix WebUI Applications: Mehrere Schwachstellen

CVE-2023-42371 · CVE-2024-37629 · CVE-2024-52798 · CVE-2024-55565

WID-SEC-W-2025-0580: IBM License Metric Tool: Mehrere Schwachstellen

CVE-2024-10917 · CVE-2024-12797 · CVE-2024-21208 · CVE-2024-21210 · CVE-2024-21217 · CVE-2024-21235 · CVE-2024-45296 · CVE-2024-52798 · CVE-2024-57965 · CVE-2025-27111 · CVE-2025-27152 · CVE-2025-25184

RHSA-2024:6121: Red Hat Security Advisory: OpenShift Container Platform 4.18.1 security and extras update

CVE-2019-25210 · CVE-2023-44270 · CVE-2024-21538 · CVE-2024-45337 · CVE-2024-45338 · CVE-2024-45590 · CVE-2024-48910 · CVE-2024-52798 · CVE-2024-55565 · CVE-2024-56201 · CVE-2024-56326 · CVE-2025-21613 · CVE-2025-21614

RHSA-2025:0775: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.17.3 Bug Fix Update

CVE-2024-45338 · CVE-2024-52798

Source published
Dec 5, 2024, 10:45:42 PM (timezone not stated)
Source modified
Jan 24, 2025, 8:03:11 PM (timezone not stated)
Saved here
15 Nov 2026 02:36:42 UTC
Source terms
ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

EUVD CVSS 4.0 · 7.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

nvd · CVE-2024-52798

Published

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can b…

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.

Additional publisher context

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-1333

Original publisher date fields

published: 2024-12-05T23:15:06.310

lastModified: 2026-06-17T08:07:38.863

Source published
5 Dec 2024 23:15:06 UTC
Source modified
17 Jun 2026 08:07:38 UTC
Saved here
25 Oct 2026 01:17:12 UTC
Source terms
NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 4.0 · [email protected] · Secondary · 7.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

osv · GHSA-rhx6-c78j-4q9w

Published

path-to-regexp contains a ReDoS

### Impact The regular expression that is vulnerable to backtracking can be generated in versions before 0.1.12 of `path-to-regexp`, originally reported in CVE-2024-45296 ### Patches Upgrade to 0.1.12. ### Workarounds Avoid using two parameters within a single path segment, when the separator is not `.` (e.g. no `/:a-:b`). Alternatively, you can define the regex used for both parameters and ensure they do not overlap to allow backtracking. ### References - https://github.com/advisories/GHSA-9wv6-86v2-598j - https://blakeembrey.com/posts/2024-09-web-redos/

Source published
5 Dec 2024 22:40:47 UTC
Source modified
10 Sep 2026 03:50:56 UTC
Saved here
24 Oct 2026 13:17:17 UTC
Source terms
GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

Publisher rating · HIGH

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 15 Nov 12:11 UTC · 256 of 275 readable · 252 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners.