Vulnerability · Published Jul 24, 2022 · Assigned by apache

CVE-2022-24294ReDoS in Apache MXNet RTC Module

High 7.5

In plain English

A high-severity uncontrolled resource consumption in Apache MXNet from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High

Exploit odds (30 days)1.9%top 20.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A regular expression used in Apache MXNet (incubating) is vulnerable to a potential denial-of-service by excessive resource consumption. The bug could be exploited when loading a model in Apache MXNet that has a specially crafted operator name that would cause the regular expression evaluation to use excessive resources to attempt a match. This issue affects Apache MXNet versions prior to 1.9.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	mxnet	1.9.1	GHSA-xxj3-55p6-xg3h
PyPI	mxnet	1.9.1	PYSEC-2026-850

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache MXNet	unspecified – before 1.9.1

Weakness: CWE-400

References

https://lists.apache.org/thread/b1fbfmvzlr2bbp95lqoh3mtovclfcl3o x_refsource_MISC
[oss-security] 20220724 CVE-2022-24294: ReDoS in Apache MXNet RTC Module mailing-list, x_refsource_MLIST