What’s Vulnerable › Vulnerabilities

CVE-2024-9506: Regular Expression Denial of Service (ReDoS)

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-10-15 · updated 2026-06-17
• Weakness: CWE-1333

Description

Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability.

Affected products

• vue: from 2.0.0 through 2.7.16

References

• https://www.herodevs.com/vulnerability-directory/cve-2024-9506

Get alerted when CVE-2024-9506 or the next vulnerability affects your stack