CVE-2024-8789: Lunary Lunary ReDoS DoS Vulnerability

CVE-2024-8789 Overview

CVE-2024-8789 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting Lunary-ai/lunary at git commit 105a3f6. The application permits users to upload arbitrary regular expressions that are then evaluated server-side. Attackers can submit crafted patterns with exponential runtime complexity, causing the server to consume CPU resources and become unresponsive. The flaw is tracked under CWE-1333: Inefficient Regular Expression Complexity and is exploitable over the network without authentication or user interaction.

Critical Impact
An unauthenticated remote attacker can render the Lunary service unavailable by submitting a single malicious regular expression that triggers catastrophic backtracking on the server.

Affected Products

Lunary-ai/lunary at git commit 105a3f6
Lunary application instances accepting user-supplied regular expressions
Self-hosted Lunary deployments prior to the patched commit

Discovery Timeline

2025-03-20 - CVE-2024-8789 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8789

Vulnerability Analysis

The vulnerability resides in Lunary's server-side regex evaluation logic. The application exposes functionality that allows users to submit regular expressions for execution against input data. The regex engine used by the runtime employs backtracking, and it does not enforce timeouts or complexity limits on the supplied patterns.

Certain regex constructs, such as nested quantifiers and overlapping alternations, produce exponential worst-case matching behavior. When an attacker supplies such a pattern along with a matching input, the engine explores an exponential number of paths, consuming a single CPU core for an unbounded duration. Concurrent submission of multiple malicious patterns can exhaust all worker threads, halting request processing across the service.

Root Cause

The root cause is the absence of input validation and execution controls on user-supplied regular expressions. Lunary directly compiles and executes attacker-controlled patterns without static analysis for pathological constructs, without runtime execution timeouts, and without isolating regex evaluation from primary application workers. This combination allows algorithmic complexity attacks against the service.

Attack Vector

An unauthenticated network attacker sends a request containing a crafted regular expression to a Lunary endpoint that accepts user-defined patterns. Patterns such as (a+)+$ evaluated against a long string of a characters followed by a non-matching terminator produce catastrophic backtracking. The server thread executing the match becomes unresponsive until the operation completes or is terminated. Refer to the Huntr Bounty Report for the full technical write-up.

Detection Methods for CVE-2024-8789

Indicators of Compromise

Sustained 100% CPU utilization on Lunary worker processes without corresponding legitimate traffic volume
HTTP requests to Lunary endpoints containing regex patterns with nested quantifiers such as (a+)+, (a|a)+, or (.*)*
Long-running or timed-out HTTP requests against endpoints that accept user-defined regular expressions
Repeated regex submissions from a single source IP followed by service degradation

Detection Strategies

Inspect application logs for regex compilation events tied to abnormally long execution times
Deploy a web application firewall rule to identify suspicious regex patterns containing nested quantifiers in request payloads
Correlate CPU spikes on Lunary hosts with inbound request patterns targeting regex-accepting endpoints
Monitor request duration percentiles on Lunary APIs to flag statistical anomalies indicating algorithmic attacks

Monitoring Recommendations

Track per-request CPU time and terminate handlers exceeding a defined threshold
Alert on repeated requests from the same source containing regex metacharacters such as +, *, and grouping constructs
Enable telemetry on regex execution duration and log patterns exceeding a millisecond-based threshold for offline analysis

How to Mitigate CVE-2024-8789

Immediate Actions Required

Update Lunary to a build that includes commit 7ff89b0304d191534b924cf063f3648206d497fa
Restrict access to endpoints that accept user-defined regular expressions to authenticated and trusted users only
Place Lunary instances behind a reverse proxy that enforces request timeouts and body size limits
Rate-limit requests to regex-processing endpoints to reduce the impact of denial-of-service attempts

Patch Information

The maintainers addressed the issue in GitHub commit 7ff89b0304d191534b924cf063f3648206d497fa. Administrators of self-hosted Lunary deployments should pull the latest release and redeploy. Verify that the deployed build post-dates the vulnerable commit 105a3f6.

Workarounds

Disable or restrict any Lunary feature that permits arbitrary user-supplied regular expressions until the patch is applied
Wrap regex evaluation with a hard execution timeout using worker threads or a sandboxed regex engine such as RE2
Apply input length limits to strings evaluated against user-provided regex patterns to bound worst-case runtime
Allowlist regex constructs by rejecting patterns containing nested quantifiers before compilation

bash

# Configuration example: enforce request timeout at reverse proxy (nginx)
location /api/regex/ {
    proxy_pass http://lunary_backend;
    proxy_read_timeout 2s;
    proxy_send_timeout 2s;
    client_max_body_size 8k;
    limit_req zone=regex_zone burst=5 nodelay;
}