CVE-2024-5552: ReDoS in kubeflow/kubeflow

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-06-06 · updated 2026-06-17
Weakness: CWE-1333

Description

kubeflow/kubeflow is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to inefficient regular expression complexity in its email validation mechanism. An attacker can remotely exploit this vulnerability without authentication by providing specially crafted input that causes the application to consume an excessive amount of CPU resources. This vulnerability affects the latest version of kubeflow/kubeflow, specifically within the centraldashboard-angular backend component. The impact of exploiting this vulnerability includes resource exhaustion, and service disruption.

Affected products

kubeflow/kubeflow: before 1.9.0 — fixed in 1.9.0

How to fix

Upgrade to a fixed version: kubeflow/kubeflow 1.9.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-5552 or the next vulnerability affects your stack