Cyber Resilience

CVE-2024-5552

Kubeflow ≤ 1.9.0

Public PoC
Published
06 June 2024
Modified
21 November 2024
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0065 48th percentile
Risk Priority 58 floored blend · peak EPSS

Summary

CVE-2024-5552 is a high-severity Inefficient Regular Expression Complexity (CWE-1333) vulnerability in Kubeflow Kubeflow. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 48th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

This vulnerability is AI-related — categorised as Other AI Platforms; in the Other ATLAS/OWASP Terms risk domain.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

kubeflow/kubeflow is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to inefficient regular expression complexity in its email validation mechanism. An attacker can remotely exploit this vulnerability without authentication by providing specially crafted input that causes the…

more

application to consume an excessive amount of CPU resources. This vulnerability affects the latest version of kubeflow/kubeflow, specifically within the centraldashboard-angular backend component. The impact of exploiting this vulnerability includes resource exhaustion, and service disruption.

CWE(s)

AI Security AnalysisAI

AI Category
Other AI Platforms
Risk Domain
Other ATLAS/OWASP Terms
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
Kubeflow is an open-source machine learning (ML) platform for Kubernetes, used for deploying and managing ML workflows, fitting the 'Other Platforms' category as it is not a framework, library, or specific AI subdomain tool.

Related Threats

MITRE ATT&CK Enterprise Techniques

T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
T1499.003 Application Exhaustion Flood Impact
Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-6571Same product: Kubeflow Kubeflow
CVE-2023-6570Same product: Kubeflow Kubeflow
CVE-2024-52524Shared CWE-1333
CVE-2026-15154Shared CWE-1333
CVE-2025-1194Shared CWE-1333
CVE-2023-6688Shared CWE-1333
CVE-2023-45813Shared CWE-1333
CVE-2026-57584Shared CWE-1333
CVE-2025-2937Shared CWE-1333
CVE-2025-27220Shared CWE-1333

Affected Assets

kubeflow
kubeflow
≤ 1.9.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Developer testing and evaluation can discover inefficient regex patterns via performance or static analysis.

Development standards and tools can require safe regex construction and forbid known exponential patterns.

Denial-of-service protections limit resource exhaustion caused by expensive regex evaluation.

Input validation can constrain data that would otherwise trigger worst-case regex complexity.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent inefficient regex via reviews, static analysis, and safe libraries.

ID.RA-01 partial match
prevents

Vulnerability identification processes can discover ReDoS issues in existing code but do not stop their introduction.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect and reject regex patterns with exponential worst-case complexity.

prevents

Secure development lifecycle mandates review of algorithmic efficiency, directly addressing ReDoS-prone regex.

prevents

Application security requirements can specify input-validation rules that limit regex complexity.

prevents

Secure architecture principles encourage avoidance of computationally expensive constructs such as catastrophic backtracking.

prevents

Secure coding standards explicitly prohibit or limit the use of inefficient regular expressions.

References