CVE-2024-8763: Lunary ReDoS Denial of Service Vulnerability

CVE-2024-8763 Overview

CVE-2024-8763 is a Regular Expression Denial of Service (ReDoS) vulnerability in the lunary-ai/lunary repository. The flaw resides in the compileTextTemplate function at git revision be54057. The vulnerable regular expression /{{(.*?)}}/g exhibits second-degree polynomial time complexity when processing input containing a large number of braces. An attacker can send crafted input over the network without authentication, causing the server to hang indefinitely and stop responding to requests. The weakness is classified as [CWE-1333]: Inefficient Regular Expression Complexity.

Critical Impact
Unauthenticated remote attackers can render the Lunary server unresponsive by submitting input crafted to trigger polynomial backtracking in the template compilation regex.

Affected Products

lunary-ai/lunary repository at git commit be54057
Lunary deployments using the vulnerable compileTextTemplate function
Any downstream applications embedding the affected template compilation logic

Discovery Timeline

2025-03-20 - CVE-2024-8763 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8763

Vulnerability Analysis

The vulnerability originates in the compileTextTemplate function, which uses the pattern /{{(.*?)}}/g to extract template placeholders from user-controlled text. The lazy quantifier .*? combined with the surrounding literal braces creates a regex engine state that requires excessive backtracking when the input contains repeated or unmatched brace sequences. The resulting complexity scales as a polynomial with respect to input length, allowing modest input sizes to consume large amounts of CPU time.

Because Lunary processes template strings through this function on the server side, a single request containing a malicious payload blocks the Node.js event loop. All subsequent requests queue behind the stalled operation, producing a full denial of service.

Root Cause

The root cause is an inefficient regular expression pattern applied to untrusted input without length limits or execution timeouts. The lazy .*? group backtracks repeatedly across long sequences of { characters that never form a valid closing }} boundary. This is a textbook ReDoS pattern documented under [CWE-1333].

Attack Vector

An unauthenticated attacker submits a network request containing a payload with many { characters directed at any endpoint that invokes compileTextTemplate. No user interaction is required. The regex engine enters a prolonged backtracking loop, saturating a CPU core and blocking the single-threaded runtime until the process is terminated or restarted.

Exploitation does not require valid credentials, authentication tokens, or elevated privileges. Repeated requests amplify the impact and can keep the service offline for extended periods. Refer to the Huntr Bug Bounty Listing for the reported reproduction details.

Detection Methods for CVE-2024-8763

Indicators of Compromise

HTTP request bodies containing unusually long runs of { characters directed at Lunary template-processing endpoints.
Sustained 100% CPU utilization on a Lunary Node.js worker process following a single inbound request.
Server unresponsiveness or request timeouts affecting all clients after a specific payload is received.

Detection Strategies

Inspect application logs for requests that immediately precede an event-loop stall or health-check failure.
Monitor the Node.js event loop lag metric and alert when it exceeds acceptable thresholds.
Deploy a Web Application Firewall (WAF) rule that flags request payloads containing high-density brace sequences.

Monitoring Recommendations

Track per-request CPU time and terminate handlers that exceed a defined budget.
Alert on abnormal ratios of inbound requests to completed responses on Lunary services.
Retain full HTTP request captures for forensic analysis of denial-of-service events.

How to Mitigate CVE-2024-8763

Immediate Actions Required

Update the lunary-ai/lunary deployment to a revision that includes commit 7ff89b0304d191534b924cf063f3648206d497fa.
Restrict network exposure of Lunary endpoints to trusted clients until patching is complete.
Enforce request body size limits on any route that reaches compileTextTemplate.

Patch Information

The maintainers addressed the vulnerability in commit 7ff89b0304d191534b924cf063f3648206d497fa. Review the fix in the GitHub Commit Change and rebuild affected deployments from a version that incorporates the patched regex logic.

Workarounds

Place a reverse proxy or WAF in front of Lunary to reject payloads with excessive brace repetition.
Cap request body sizes to a value well below the threshold that triggers pathological backtracking.
Run template compilation in an isolated worker with a strict execution timeout so stalled operations do not block the main event loop.

bash

# Configuration example: nginx request size and pattern filtering
http {
    client_max_body_size 16k;

    map $request_body $redos_suspect {
        default 0;
        "~*\\{{20,}" 1;
    }

    server {
        location / {
            if ($redos_suspect) { return 400; }
            proxy_pass http://lunary_upstream;
            proxy_read_timeout 5s;
        }
    }
}