TI-2024-26227 Aliases CVE-2024-39249 GHSA-x6xm-h7hm-7p9q

Async <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of…

MEDIUM 40CWE-1333Published 2024-07-01 · Updated 2024-08-26

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 8 fixed, 19 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-1333.

Summary

Async <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function. NOTE: this is disputed by the supplier because there is no realistic threat model: regular expressions are not used with untrusted input.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00819 57th percentileScored 2026-11-07

Fix Partial Red Hat: 7 advisoriesRed Hat: 8 fixed, 19 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE names CISA-ADP · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:async_project:async::::::::	—	—	Async Project

cpe:2.3:a:async_project:async:*:*:*:*:*:*:*:* Versions — — ·Async Project

Remediation

Red Hat 7 advisories

RHSA-2025:8551 Released 2025-06-04 · Red Hat rating Important
Red Hat OpenShift Data Foundation 4.14.18 Bug Fix Update
- RHODF 4.14 for RHEL 9 odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9, odf4/odf-multicluster-console-rhel9 +1
RHSA-2025:8544 Released 2025-06-04 · Red Hat rating Important
Red Hat OpenShift Data Foundation 4.15.14 Bug Fix Update
- RHODF 4.15 for RHEL 9 odf4/mcg-rhel9-operator, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +2
RHSA-2025:8479 Released 2025-06-04 · Red Hat rating Important
RHODF-4.16-RHEL-9 security update
- RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-rhel9-operator, odf4/ocs-client-console-rhel9 +4

Show 4 more Red Hat advisories

RHSA-2025:8059 Released 2025-05-21 · Red Hat rating Important
Red Hat OpenShift Data Foundation 4.17.7 Bug Fix Update
- RHODF 4.17 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-rhel9-operator, odf4/ocs-client-console-rhel9 +8
RHSA-2024:10775 Released 2024-12-04 · Red Hat rating Moderate
ACS 4.6 enhancement and security update
- RHACS 4.6 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-roxctl-rhel8 +3
RHSA-2024:7443 Released 2024-10-01 · Red Hat rating Moderate
RHACS 4.5 enhancement and security update
- RHACS 4.5 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10
RHSA-2024:6235 Released 2024-09-03 · Red Hat rating Moderate
Red Hat Trusted Profile Analyzer 1.1.2
- Red Hat Trusted Profile Analyzer Operator 1.1 registry.redhat.io/rhtpa/rhtpa-trustification-service-rhel9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Migration Toolkit for Applications 6	Affected	No fix planned: Will not fix
Multicluster Engine for Kubernetes	Affected	No fix planned: Will not fix
Network Observability Operator	Affected	No fix planned: Will not fix
Node HealthCheck Operator	Affected	No fix planned: Will not fix
OpenShift Pipelines	Affected	No fix planned: Will not fix
OpenShift Serverless	Affected	No fix planned: Will not fix
Red Hat 3scale API Management Platform 2	Affected	No fix planned: Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2	Affected	No fix planned: Will not fix
Red Hat Advanced Cluster Security 3	Affected	No fix planned: Will not fix
Red Hat Ansible Automation Platform 2	Affected	No fix yet
Red Hat Fuse 7	Affected	No fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)	Affected	No fix planned: Will not fix
Red Hat OpenShift Container Platform 4	Affected	No fix yet: Fix deferred
Red Hat OpenShift Data Science (RHODS)	Affected	No fix planned: Will not fix
Red Hat OpenShift Dev Spaces	Affected	No fix planned: Will not fix
Red Hat OpenShift GitOps	Affected	No fix planned: Will not fix
Red Hat OpenShift Virtualization 4	Affected	No fix planned: Will not fix
Red Hat Process Automation 7	Affected	No fix planned: Will not fix
Red Hat Trusted Profile Analyzer	Affected	No fix yet
RHACS 4.5 for RHEL 8	Fixed	RHSA-2024:7443
RHACS 4.6 for RHEL 8	Fixed	RHSA-2024:10775
RHODF 4.14 for RHEL 9	Fixed	RHSA-2025:8551
RHODF 4.15 for RHEL 9	Fixed	RHSA-2025:8544
RHODF 4.16 for RHEL 9	Fixed	RHSA-2025:8479
RHODF 4.17 for RHEL 9	Fixed	RHSA-2025:8059
Red Hat Developer Hub 1.3 for RHEL 9	Fixed	—
Red Hat Trusted Profile Analyzer Operator 1.1	Fixed	RHSA-2024:6235

Not affected: 20 products

Migration Toolkit for Applications 7
Migration Toolkit for Virtualization
RHACS 4.6 for RHEL 8
RHODF 4.14 for RHEL 9
RHODF 4.15 for RHEL 9
RHODF 4.16 for RHEL 9
RHODF 4.17 for RHEL 9
Red Hat Ansible Automation Platform 2
Red Hat Build of Keycloak
Red Hat Developer Hub 1
Red Hat Developer Hub 1.3 for RHEL 9
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat JBoss Enterprise Application Platform 7
Red Hat JBoss Enterprise Application Platform 8
Red Hat OpenShift AI (RHOAI)
Red Hat OpenShift Container Platform 4
Red Hat OpenShift Dev Spaces
Red Hat Openshift Data Foundation 4

Timeline

2026-10-02 Threatist record created from CVE-2024-39249
2026-10-03 Alias added: GHSA-x6xm-h7hm-7p9q
2026-10-13 Affected versions changed · Red Hat
2026-10-27 Affected versions changed · Red Hat

References

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences