CVE-2024-21490

CVE-2024-21490 affects the AngularJS package (angular) from version 1.3.0 onward. A regular expression used to parse the value of the ng-srcset directive is vulnerable to catastrophic backtracking, a type of ReDoS (Regular Expression Denial of Service). When the regex is applied to a carefully crafted large input, the matching time grows super-linearly, which can exhaust server resources or cause browser unresponsiveness. [1][3][4]

An attacker can exploit this by providing a malicious ng-srcset value—for example via a crafted URL, user input that populates a directive, or by injecting into an AngularJS template. No authentication is required if an application reflects unsanitized user data in an ng-srcset binding. The attack surface is client-side, but a server-side rendering environment could also be affected if it processes such templates. [1][4]

The impact is a Denial of Service: the browser or Node process may hang or become unresponsive while the regex engine backtracks, degrading user experience or taking down a server-side AngularJS rendering service. This vulnerability does not lead to remote code execution or data theft. [3][4]

AngularJS reached its end-of-life in January 2022, and the vendor will not release a patch for this issue. Users are advised to migrate to the actively supported @angular/core framework. The Debian LTS team has included a fix in angular.js package updates. [1][2]