{"id":"CVE-2024-21490","details":"This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. \r\r\r**Note:**\r\rThis package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).","aliases":["GHSA-4w4v-5hc9-xrr2"],"modified":"2026-03-15T22:48:22.750777Z","published":"2024-02-10T05:15:08.650Z","related":["CGA-xmrf-289g-g3q6"],"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html"},{"type":"ADVISORY","url":"https://security.snyk.io/vuln/SNYK-JS-ANGULAR-6091113"},{"type":"ADVISORY","url":"https://support.herodevs.com/hc/en-us/articles/25715686953485-CVE-2024-21490-AngularJS-Regular-Expression-Denial-of-Service-ReDoS"},{"type":"ADVISORY","url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6241746"},{"type":"ADVISORY","url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6241747"},{"type":"EVIDENCE","url":"https://stackblitz.com/edit/angularjs-vulnerability-ng-srcset-redos"}],"affected":[{"database_specific":{"unresolved_ranges":[{"events":[{"introduced":"1.3.0"}]}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-21490.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}