Security readout for executives and security teams
Plain-English summary
CVE-2024-21490 is a denial-of-service issue in legacy AngularJS handling of ng-srcset. A specially large crafted value can make a regular expression consume excessive CPU, potentially making an affected application unavailable. The package is end-of-life, and the provided sources say it will not receive normal upstream updates.
Executive priority
Prioritize replacement or supported remediation for internet-facing legacy AngularJS applications. The issue affects availability rather than data theft, but EOL status increases operational risk because standard upstream fixes are not expected.
Technical view
The vulnerability is CWE-1333: inefficient regular expression complexity. Angular/angularjs packages from the 1.3.0 line are described as affected. The vulnerable regex is used to split ng-srcset directive values, allowing super-linear backtracking and availability impact. CVSS is 7.5 high, network reachable, low complexity, no privileges or user interaction required.
Likely exposure
Exposure is most likely in applications still shipping AngularJS or legacy angular packages, including Java WebJars and .NET angularjs package variants. Risk depends on whether untrusted or attacker-controlled content can reach ng-srcset processing.
Exploitation context
The bundle shows KEV is false, so active exploitation is not established here. CVSS indicates remote, unauthenticated denial-of-service potential, and the references include public vulnerability and demonstration material. Treat internet-facing legacy AngularJS surfaces as higher priority.
Researcher notes
Evidence supports ReDoS in ng-srcset parsing with availability impact. Do not assume all applications are exploitable; validate data flow into the directive. No KEV listing is provided, and no universal fixed version is identified in the bundle.
Mitigation direction
- Inventory and remove legacy AngularJS/angular dependencies where possible.
- Plan migration to @angular/core, as named in the advisory text.
- Check HeroDevs and package ecosystem guidance for supported remediation options.
- For Debian packages, review the Debian LTS advisory before deciding package actions.
- Limit untrusted input paths that can influence ng-srcset values.
Validation and detection
- Search dependency manifests for angular, angularjs, and WebJars Angular packages.
- Identify runtime pages or templates using ng-srcset.
- Confirm whether attacker-controlled data can populate ng-srcset values.
- Check whether affected assets are exposed on public routes.
- Record package source, version, and vendor guidance for each finding.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1333: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-21490 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P3.93.6snykVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://security.snyk.io/vuln/SNYK-JS-ANGULAR-6091113CVE reference, snyk
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6241746CVE reference, snyk
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6241747CVE reference, snyk
- https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJS-10771616CVE reference, snyk
- https://stackblitz.com/edit/angularjs-vulnerability-ng-srcset-redosCVE reference, snyk
- https://support.herodevs.com/hc/en-us/articles/25715686953485-CVE-2024-21490-AngularJS-Regular-Expression-Denial-of-Service-ReDoSCVE reference, CVE · x_transferred
- https://lists.debian.org/debian-lts-announce/2025/07/msg00005.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Inefficient Regular Expression Complexity
Inefficient Regular Expression Complexity represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.