Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2024-8049 is a medium-severity Excessive Iteration (CWE-834) vulnerability in Progress Telerik Document Processing Libraries. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 34th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-8 (Security and Privacy Engineering Principles) and SC-6 (Resource Availability) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-48906
Vulnerability Data
In Progress Telerik Document Processing Libraries, versions prior to 2024 Q4 (2024.4.1106), importing a document with unsupported features can lead to excessive processing, leading to excessive use of computing resources leaving the application process unavailable.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 2 hardening rules · 2 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Engineering principles can require developers to bound all loops and iterations at design time.
Resource quotas limit the CPU/time impact of an excessively long loop without eliminating the flaw.
Input validation can reject or sanitize data that would otherwise drive unbounded iteration.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent unbounded loops via code review, static analysis, and testing.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect excessive iteration through stress and fuzz testing.
Secure development lifecycle requires input validation and loop bounds, directly limiting excessive iteration.
Application security requirements include resource-consumption limits that prevent unbounded loops.
Secure architecture principles mandate defensive coding patterns such as loop termination checks.
Secure coding standards explicitly forbid unbounded loops and require explicit iteration limits.