What’s Vulnerable › Vulnerabilities

CVE-2024-8789: Regular Expression Denial of Service (ReDoS) in lunary-ai/lunary

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-03-20 · updated 2026-06-17
• Weakness: CWE-1333

Description

Lunary-ai/lunary version git 105a3f6 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. The application allows users to upload their own regular expressions, which are then executed on the server side. Certain regular expressions can have exponential runtime complexity relative to the input size, leading to potential denial of service. An attacker can exploit this by submitting a specially crafted regular expression, causing the server to become unresponsive for an arbitrary length of time.

Affected products

• lunary-ai/lunary: before 1.4.23 — fixed in 1.4.23

How to fix

Upgrade to a fixed version: lunary-ai/lunary 1.4.23. Check the vendor advisory for mitigations.

References

• https://github.com/lunary-ai/lunary/commit/7ff89b0304d191534b924cf063f3648206d497fa
• https://huntr.com/bounties/e32f5f0d-bd46-4268-b6b1-619e07c6fda3

Get alerted when CVE-2024-8789 or the next vulnerability affects your stack