CVE-2024-8763

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the lunary-ai/lunary repository, specifically in the compileTextTemplate function. The affected version is git be54057. An attacker can exploit this vulnerability by manipulating the regular expression /{{(.*?)}}/g, causing the server to hang indefinitely and become unresponsive to any requests. This is due to the regular expression's susceptibility to second-degree polynomial time complexity, which can be triggered by a large number of braces in the input.

• CWE-1333

• https://github.com/lunary-ai/lunary/commit/7ff89b0304d191534b924cf063f3648206d497faPatch
• https://huntr.com/bounties/4fb63a6e-0056-4550-a34d-e161de1c13b8Exploit, Third Party Advisory

Published

Mar 20, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-8757The WP Post Author – Boost Your Blog's Engagement with …7.2
• CVE-2024-8758The Quiz and Survey Master (QSM) WordPress plugin before 9.…4.8
• CVE-2024-8759The Nested Pages WordPress plugin before 3.2.9 does not sani…4.8
• CVE-2024-8760The Stackable – Page Builder Gutenberg Blocks plugin for Wor…5.3
• CVE-2024-8761The Share This Image plugin for WordPress is vulnerable to O…6.1
• CVE-2024-8762A vulnerability was found in code-projects Crud Operation Sy…9.8
• CVE-2024-8764A vulnerability in lunary-ai/lunary, as of commit be54057, a…7.5
• CVE-2024-8765In lunary-ai/lunary, the privilege check mechanism is flawed…7.3
• CVE-2024-8766Local privilege escalation due to DLL hijacking vulnerabilit…6.7
• CVE-2024-8767Sensitive data disclosure and manipulation due to unnecessar…9.9
• CVE-2024-8768A flaw was found in the vLLM library. A completions API requ…7.5
• CVE-2024-8769A vulnerability in the `LockManager.release_locks` function …9.1