CVE-2024-8764 Improper Authorization in lunary-ai/lunary
Attackers can cause server denial of service by uploading malicious regular expressions that consume excessive resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-8764?
CVE-2024-8764 is a high-severity denial of service vulnerability in Lunary Lunary, published on 20 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in lunary-ai/lunary, as of commit be54057, allows users to upload and execute arbitrary regular expressions on the server side. This can lead to a Denial of Service (DoS) condition, as certain regular expressions can cause excessive resource consumption, blocking the server from processing other requests.
Weakness: CWE-1333
Which versions are affected by CVE-2024-8764?
It affects 1 product.
Products include Lunary Lunary.
How do I fix CVE-2024-8764?
No fix has been published for CVE-2024-8764 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-8764 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-8764 exists.
Other vulnerabilities in Lunary Lunary
- CVE-2024-8999 Improper Access Control in lunary-ai/lunary
- CVE-2024-9095 Improper Authorization in lunary-ai/lunary
- CVE-2024-7456 SQL Injection in lunary-ai/lunary
- CVE-2024-4146 Incorrect Authorization in lunary-ai/lunary
- CVE-2024-5386 Account Hijacking via Password Reset Token Leak in lunary-ai/lunary
Sources
Also known as GHSA-j8x9-qc9m-rmhj.