Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-21539 is a high-severity Inefficient Regular Expression Complexity (CWE-1333) vulnerability in Snyk (inferred from references). Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique OS Exhaustion Flood (T1499.001); ranked at the 42th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-10 (Concurrent Session Control) and SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-3213
Vulnerability Data
Versions of the package @eslint/plugin-kit before 0.2.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by exploiting this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 5 hardening rules · 3 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces a hard limit on concurrent sessions, structurally preventing unbounded resource allocation.
Developer testing and evaluation can discover inefficient regex patterns via performance or static analysis.
Requires explicit allocation of resources by priority or quota, directly stopping unlimited allocation.
Imposes a limit on consecutive invalid attempts, preventing one specific class of unbounded resource consumption.
Development standards and tools can require safe regex construction and forbid known exponential patterns.
Denial-of-service protections limit resource exhaustion caused by expensive regex evaluation.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Vulnerability identification processes can discover ReDoS issues in existing code but do not stop their introduction.
Monitoring capacity and taking action to maintain availability directly reduces unchecked resource allocation.
Secure SDLC practices directly prevent inefficient regex via reviews, static analysis, and safe libraries.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248552 OL 8 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive. blocks CWE-770
- V-248553 OL 8 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive. blocks CWE-770
Oracle Linux 9 (2 rules)
- V-271710 OL 9 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive. blocks CWE-770
- V-271709 OL 9 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive. blocks CWE-770
RHEL 8 (1 rule)
- V-230244 RHEL 8 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive. blocks CWE-770