CVE-2024-7779: Danswer AI ReDoS Denial of Service Flaw

CVE-2024-7779 Overview

CVE-2024-7779 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting danswer-ai/danswer version 1. An unauthenticated remote attacker can submit crafted input that triggers catastrophic backtracking in vulnerable regular expressions. The result is severe CPU consumption that slows or halts application response.

The issue is tracked under CWE-1333: Inefficient Regular Expression Complexity. It carries a CVSS 3.0 base score of 7.5 with availability impact rated High. No authentication or user interaction is required to trigger the condition.

Critical Impact

Unauthenticated attackers can render the danswer application unresponsive by sending crafted input that forces exponential regex evaluation, exhausting server CPU resources.

Affected Products

• danswer-ai/danswer version 1

Discovery Timeline

• 2025-03-20 - CVE-2024-7779 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7779

Vulnerability Analysis

The vulnerability resides in regular expression processing paths within danswer-ai/danswer. Attackers manipulate user-supplied input processed by vulnerable regex patterns to cause catastrophic backtracking. The regex engine spends exponential time evaluating alternatives against the crafted input.

Because the attack vector is network-based and requires no privileges, any user who can reach the application endpoint can trigger it. A single request can consume significant CPU cycles. Repeated requests can render the application entirely unresponsive to legitimate users.

At the time of publication, the EPSS score is 0.664% with a percentile of 47.29, indicating a moderate exploitation likelihood relative to other published CVEs. Technical details are documented in the Huntr Bug Bounty Report.

Root Cause

The root cause is inefficient regular expression complexity classified under [CWE-1333]. One or more regex patterns in danswer contain ambiguous quantifiers or nested repetition. When the engine encounters input that does not match, it explores every possible permutation before failing. Execution time grows exponentially with input length.

Attack Vector

An attacker submits crafted strings through any application input that flows into the vulnerable regex. Because these regexes typically process user data during query handling or content parsing, the attack surface is exposed on standard HTTP endpoints. No authentication is required, and the request appears syntactically valid.

The vulnerability is described in prose only; no verified proof-of-concept code is published in the available references. See the Huntr Bug Bounty Report for additional technical context.

Detection Methods for CVE-2024-7779

Indicators of Compromise

• Sustained high CPU utilization on danswer application processes without corresponding legitimate workload
• HTTP requests containing unusually long or highly repetitive character sequences targeting search, parsing, or filtering endpoints
• Elevated request latency and timeouts on endpoints that process user-supplied text
• Worker or thread pool exhaustion in application logs

Detection Strategies

• Instrument the application to log regex execution time and flag evaluations exceeding a reasonable threshold
• Baseline normal request payload sizes and alert on outliers targeting text-processing endpoints
• Monitor for repeated requests from a single source containing repetitive patterns such as long runs of the same character

Monitoring Recommendations

• Track per-process CPU utilization and correlate spikes with inbound HTTP request patterns
• Enable rate limiting metrics and alerting on 5xx responses and request timeouts
• Aggregate web application firewall (WAF) logs to identify payloads that match known ReDoS attack signatures

How to Mitigate CVE-2024-7779

Immediate Actions Required

• Upgrade danswer-ai/danswer to a version later than 1 that addresses the vulnerable regex patterns
• Enforce strict input length limits on all endpoints that process user-supplied text
• Deploy a WAF rule set that inspects for known ReDoS attack payloads and repetitive character sequences
• Apply request-level timeouts and per-client rate limiting to contain resource consumption

Patch Information

No vendor advisory URL is available in the enriched data. Review the upstream danswer-ai/danswer repository and the Huntr Bug Bounty Report for the fixed version and remediation commits.

Workarounds

• Place danswer behind a reverse proxy that enforces maximum request body size and request timeout
• Restrict access to authenticated users on trusted networks until the patched version is deployed
• Replace vulnerable regex patterns with linear-time alternatives or use a regex engine that guarantees linear execution such as RE2

# Configuration example: enforce timeouts and body size in nginx reverse proxy
http {
    client_max_body_size 16k;
    client_body_timeout 5s;
    send_timeout 5s;

    limit_req_zone $binary_remote_addr zone=danswer:10m rate=10r/s;

    server {
        location / {
            limit_req zone=danswer burst=20 nodelay;
            proxy_read_timeout 10s;
            proxy_pass http://danswer_upstream;
        }
    }
}