CVE-2024-1892

CVSS 3.1 Score 6.5 of 10 (medium)

Details

Published Feb 28, 2024
Updated: Jan 10, 2025
CWE ID 1333

Summary

CVE-2024-1892 is a newly identified vulnerability affecting the XMLFeedSpider class in the Scrapy project. This issue is categorized as a Regular Expression Denial of Service (ReDoS) vulnerability. Maliciously crafted XML content can lead to inefficient regular expression complexity during the parsing process, resulting in a denial-of-service (DoS) condition. The system may become unresponsive and consume extensive resources when processing such content, potentially impacting services that utilize Scrapy for XML processing.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share