CVE-2024-8764: Lunary Lunary DOS Vulnerability

CVE-2024-8764 Overview

CVE-2024-8764 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting the lunary-ai/lunary project as of commit be54057. The application accepts user-supplied regular expressions and executes them server-side without validation or resource limits. Attackers can submit crafted patterns that trigger catastrophic backtracking, exhausting CPU resources and blocking the server from handling legitimate requests. The flaw is tracked under CWE-1333 (Inefficient Regular Expression Complexity) and requires no authentication or user interaction to exploit.

Critical Impact
Unauthenticated remote attackers can render the Lunary service unavailable by submitting malicious regex patterns that consume server CPU resources indefinitely.

Affected Products

lunary-ai/lunary at commit be54057
All prior versions before the fix in commit 7ff89b0304d191534b924cf063f3648206d497fa
Deployments exposing regex-processing endpoints to untrusted input

Discovery Timeline

2025-03-20 - CVE-2024-8764 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8764

Vulnerability Analysis

The vulnerability stems from unrestricted server-side evaluation of user-controlled regular expressions in Lunary. When Lunary compiles and executes attacker-supplied patterns against target strings, certain constructions force the regex engine into exponential backtracking. This behavior consumes a full CPU core per request and blocks the event loop in single-threaded runtimes such as Node.js.

Because the affected endpoint is network-reachable and requires no privileges, a single HTTP request containing a pathological pattern can degrade service availability. Sustained exploitation from a single source can take the application fully offline without triggering typical volumetric DDoS defenses.

The upstream fix in commit 7ff89b0304d191534b924cf063f3648206d497fa addresses the root cause by removing or constraining execution of untrusted regex input. Full remediation details are available in the Huntr Bounty Report.

Root Cause

The root cause is inefficient regular expression complexity [CWE-1333]. Lunary accepts arbitrary regex strings from users and passes them directly to the runtime regex engine. No timeout, complexity analysis, or safe-regex validation is applied before execution. Adversarial patterns using nested quantifiers such as (a+)+$ or overlapping alternations produce exponential match times against crafted input strings.

Attack Vector

An unauthenticated attacker sends an HTTP request to a Lunary endpoint that accepts a regex parameter. The attacker includes a catastrophic backtracking pattern paired with an input string designed to force exhaustive branching. The server thread compiling and running the pattern stalls, exhausting available CPU. Repeated requests amplify the effect and produce sustained denial of service. The EPSS score for this CVE is 0.761% (50.88th percentile) as of 2026-07-07.

No verified proof-of-concept code is publicly available. Technical details are described in the linked GitHub commit and Huntr disclosure.

Detection Methods for CVE-2024-8764

Indicators of Compromise

Sustained single-core CPU saturation on Lunary application processes without corresponding traffic volume increases
HTTP requests containing regex parameters with nested quantifiers such as (a+)+, (a|a)+, or (.*)+
Event loop lag or request timeouts on endpoints that process user-supplied regular expressions
Repeated requests from a single source targeting the same regex-accepting endpoint

Detection Strategies

Inspect application logs for regex parameters containing known ReDoS constructions and flag long-running request handlers
Deploy runtime monitors that terminate regex evaluations exceeding a defined execution time budget
Correlate HTTP request duration outliers with process-level CPU spikes on Lunary hosts

Monitoring Recommendations

Alert on any Lunary request exceeding baseline latency by an order of magnitude, especially on regex-handling routes
Track per-source request rates against endpoints that accept pattern input and rate-limit anomalies
Monitor Node.js event loop delay metrics and CPU utilization per worker to identify stalled workers early

How to Mitigate CVE-2024-8764

Immediate Actions Required

Update lunary-ai/lunary to a build that includes commit 7ff89b0304d191534b924cf063f3648206d497fa or later
Restrict network access to Lunary endpoints that accept regex input until the patch is applied
Add a web application firewall rule to block requests containing high-risk regex constructs targeting affected routes

Patch Information

The maintainers resolved the issue in commit 7ff89b0304d191534b924cf063f3648206d497fa. Deploy the fixed version and redeploy any container images or serverless functions built from vulnerable source. See the official GitHub commit for the exact code changes.

Workarounds

Wrap regex evaluations in a worker thread with a strict execution timeout to prevent event loop blocking
Validate user-supplied patterns using a safe-regex library that rejects exponential constructs before execution
Disable or gate regex-accepting endpoints behind authentication and per-user rate limits

bash

# Example: enforce timeout when running the Lunary service
# Restrict CPU time per process as a defense-in-depth control
ulimit -t 5
node --max-old-space-size=512 server.js