{"id":"CVE-2024-45813","summary":"ReDoS vulnerability in multiparametric routes in  find-my-way","details":"find-my-way is a fast, open source HTTP router, internally using a Radix Tree (aka compact Prefix Tree), supports route params, wildcards, and it's framework independent. A bad regular expression is generated any time one has two parameters within a single segment, when adding a `-` at the end, like `/:a-:b-`. This may cause a denial of service in some instances. Users are advised to update to find-my-way v8.2.2 or v9.0.1. or subsequent versions. There are no known workarounds for this issue.","aliases":["GHSA-rrr8-f88r-h8q6"],"modified":"2026-08-12T03:51:36.205053529Z","published":"2024-09-18T16:47:57.138Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45813.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-1333"]},"references":[{"type":"WEB","url":"https://blakeembrey.com/posts/2024-09-web-redos"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45813.json"},{"type":"ADVISORY","url":"https://github.com/delvedor/find-my-way/security/advisories/GHSA-rrr8-f88r-h8q6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45813"},{"type":"FIX","url":"https://github.com/delvedor/find-my-way/commit/5e9e0eb5d8d438e06a185d5e536a896572dd0440"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/delvedor/find-my-way","events":[{"introduced":"0"},{"introduced":"7e018631481498ed392eb9894808c9f7da5f509e"},{"fixed":"5e9e0eb5d8d438e06a185d5e536a896572dd0440"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"8.2.2"},{"introduced":"= 9.0.0"},{"last_affected":"= 9.0.0"}]}}],"versions":["= 9.0.0","v9.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-45813.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}