CVE-2024-36751

What it actually does

The flaw is a Regular Expression Denial of Service condition in URL parsing logic. A specially crafted URL can trigger excessive regular-expression backtracking, causing the parsing process to consume CPU for an extended period. The impact is availability-focused: the vulnerable process may become slow, block request-handling threads, exhaust worker capacity, or become unresponsive. The CVSS vector indicates network reachability, low attack complexity, low privileges required, no user interaction, and high availability impact, with no direct confidentiality or integrity impact.

Why it matters to the business

Successful exploitation can degrade or interrupt services that parse attacker-controlled URLs, such as web applications, API gateways, ingestion services, scanning tools, or automation that processes user-submitted links. Operationally, this may cause request timeouts, elevated latency, worker restarts, autoscaling events, or localized service outages. This issue is not currently listed in CISA KEV, is not marked as ransomware-used, has low EPSS, and has no reported exploit maturity in the provided data, so prioritization should be risk-based; internet-exposed or high-volume URL-processing services should still be remediated promptly.

How an attack unfolds

An attacker first identifies an application path, API parameter, upload workflow, or background job that passes user-controlled URL strings into the vulnerable parsing component. The attacker then submits a malformed or unusually structured URL designed to trigger inefficient regular-expression evaluation. When the vulnerable parser processes the input, CPU time is consumed disproportionately, tying up the application thread or worker. Repeated submissions can amplify the effect, causing slow responses, queue buildup, service degradation, or process restarts. Because the weakness is availability-oriented, exploitation generally leaves symptoms such as latency spikes, request timeouts, high CPU usage, and repeated handling of anomalous URL-like inputs rather than data theft artifacts.

How to fix it

Upgrade affected components to vendor-fixed versions and rebuild or redeploy applications that bundle the vulnerable parser. For the listed Ubuntu packages, update Ubuntu 16.04 LTS systems to file 1:5.25-2ubuntu1.2 or later and Ubuntu 18.04 LTS systems to file 1:5.32-2ubuntu0.2 or later. If the vulnerable parse-uri library is used directly by an application, remove version 1.0.9 from dependency trees and upgrade to a fixed upstream release when available. Where immediate upgrade is not possible, mitigate by enforcing strict URL length limits, rejecting malformed URL patterns before parsing, applying request rate limits, isolating parsing work with execution timeouts, and ensuring worker pools cannot be fully exhausted by URL parsing tasks.

How to confirm the fix worked

Confirm remediation by checking package and dependency versions on all affected systems, containers, and build artifacts. On Ubuntu systems, verify installed file package versions meet or exceed 1:5.25-2ubuntu1.2 for Ubuntu 16.04 LTS and 1:5.32-2ubuntu0.2 for Ubuntu 18.04 LTS. For applications, inspect dependency manifests and lockfiles to ensure parse-uri v1.0.9 is no longer present, then rebuild images or artifacts from clean dependencies. Perform controlled negative testing with malformed and long URL inputs in a non-production environment and verify that parsing returns quickly, rejects invalid input, or times out safely without sustained CPU spikes. Also validate that edge controls enforce URL size limits and rate limits as intended.

Typical attack path

1. Identify an externally reachable or authenticated feature that accepts URL input.
2. Submit malformed, oversized, or highly repetitive URL-like strings to the vulnerable parser.
3. Cause excessive regular-expression backtracking during URL parsing.
4. Tie up application workers, threads, or event-loop processing capacity.
5. Repeat requests to sustain high CPU usage and trigger degraded service or denial of service.

How to detect it

Review application, web server, API gateway, reverse proxy, load balancer, APM, container, systemd, and orchestration logs for evidence of unusually long or malformed URL inputs followed by high CPU usage, request timeouts, worker exhaustion, process restarts, or autoscaling events. Focus on endpoints that accept URL parameters, webhook targets, link previews, scanners, importers, or file/content-type inspection workflows. Correlate spikes in 4xx, 499, 500, 502, 503, or 504 responses with repeated requests from the same source or authenticated principal and with application traces showing long execution time inside URL parsing or regex evaluation. Since ReDoS generally does not create a unique file artifact or stable payload signature, detection should emphasize behavioral evidence: anomalous URL-like strings, disproportionate processing time, CPU saturation, and service degradation temporally linked to inbound requests.

What your security team should do

• Inventory applications, services, containers, and packages that parse user-supplied URLs or include parse-uri v1.0.9.
• Prioritize remediation for internet-facing services, authenticated multi-user services, API endpoints, and high-volume ingestion pipelines that process URLs.
• Apply the listed Ubuntu fixed versions where applicable: file 1:5.25-2ubuntu1.2 or later on Ubuntu 16.04 LTS and file 1:5.32-2ubuntu0.2 or later on Ubuntu 18.04 LTS.
• Update application dependency manifests and lockfiles, rebuild deployed artifacts, and confirm vulnerable transitive dependencies are removed.
• Implement compensating controls: URL length caps, strict input validation, per-client rate limiting, parser execution timeouts, and worker isolation.
• Monitor for availability symptoms including high CPU, request timeouts, sudden latency increases, worker crashes, and repeated anomalous URL input.
• Because the issue is not KEV-listed and has low EPSS in the provided data, track it through standard vulnerability management unless exposure analysis shows critical service availability risk.