TI-2022-08175 Aliases CVE-2022-24294 GHSA-xxj3-55p6-xg3h

ReDoS in Apache MXNet RTC Module

LOW 37CWE-400Published 2022-07-24 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

A regular expression used in Apache MXNet (incubating) is vulnerable to a potential denial-of-service by excessive resource consumption. The bug could be exploited when loading a model in Apache MXNet that has a specially crafted operator name that would cause the regular expression evaluation to use excessive resources to attempt a match. This issue affects Apache MXNet versions prior to 1.9.1.

Why it matters now

EPSS 0.01882 79th percentileScored 2026-11-07

Fix Fixed Apache MXNet (Apache Software Foundation): 1.9.1mxnet (PyPI): 1.9.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache MXNet	before 1.9.1	1.9.1	Patch available	CNA
—	mxnet (PyPI)	before 1.9.1	1.9.1	Patch available	GHSA-xxj3-55p6-xg3h

Apache MXNet VendorApache Affected before 1.9.1 Fixed in 1.9.1 Patch available CNA
mxnet (PyPI) Vendor— Affected before 1.9.1 Fixed in 1.9.1 Patch available GHSA-xxj3-55p6-xg3h

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:mxnet::::::::	before 1.9.1	Vulnerable	Apache

cpe:2.3:a:apache:mxnet:*:*:*:*:*:*:*:* Versions before 1.9.1 Vulnerable ·Apache

Remediation

Fix · CNA Apache MXNet (Apache Software Foundation) Fixed in 1.9.1
Fix · GHSA-xxj3-55p6-xg3h mxnet (PyPI) Fixed in 1.9.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-24294
2026-10-03 Alias added: GHSA-xxj3-55p6-xg3h

References

Advisory 3

Other 2

TI-2018-01186 Information disclosure in Apache MXNet CVSS 3.0MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences