CVE-2024-1892
CVSS 3.1 Score 6.5 of 10 (medium)
Details
Published Feb 28, 2024
Updated: Jan 10, 2025
CWE ID 1333
Summary
CVE-2024-1892 is a newly identified vulnerability affecting the XMLFeedSpider class in the Scrapy project. This issue is categorized as a Regular Expression Denial of Service (ReDoS) vulnerability. Maliciously crafted XML content can lead to inefficient regular expression complexity during the parsing process, resulting in a denial-of-service (DoS) condition. The system may become unresponsive and consume extensive resources when processing such content, potentially impacting services that utilize Scrapy for XML processing.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Share
Affected Products
- Scrapy