CVE-2024-54157
Jetbrains Youtrack ≤ 2024.3.52635
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LSummary
CVE-2024-54157 is a medium-severity Inefficient Regular Expression Complexity (CWE-1333) vulnerability in Jetbrains Youtrack. Its CVSS base score is 4.3 (Medium).
Operationally, ranked at the 44th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52321
Vulnerability Data
In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detector
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect and reject regex patterns with exponential worst-case complexity.
Secure development lifecycle mandates review of algorithmic efficiency, directly addressing ReDoS-prone regex.
Application security requirements can specify input-validation rules that limit regex complexity.
Secure architecture principles encourage avoidance of computationally expensive constructs such as catastrophic backtracking.
Secure coding standards explicitly prohibit or limit the use of inefficient regular expressions.