ReDoS vulnerability in multiparametric routes in find-my-way
Priority LOW 25CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 7 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
find-my-way is a fast, open source HTTP router, internally using a Radix Tree (aka compact Prefix Tree), supports route params, wildcards, and it's framework independent. A bad regular expression is generated any time one has two parameters within a single segment, when adding a `-` at the end, like `/:a-:b-`. This may cause a denial of service in some instances. Users are advised to update to find-my-way v8.2.2 or v9.0.1. or subsequent versions. There are no known workarounds for this issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00681 52nd percentileScored 2026-11-07
Fix Partial find-my-way (delvedor): 8.2.2find-my-way (npm): 8.2.2, 9.0.1Red Hat: 5 advisoriesRed Hat: 7 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| delvedor | find-my-way | before 8.2.2; = 9.0.0 | 8.2.2 | Patch available | CNA |
| — | find-my-way (npm) | 5.5.0 to before 8.2.2 | 8.2.2 | Patch available | GHSA-rrr8-f88r-h8q6 |
| — | find-my-way (npm) | 9.0.0 to before 9.0.1 | 9.0.1 | Patch available | GHSA-rrr8-f88r-h8q6 |
- find-my-way Vendordelvedor Affected before 8.2.2; = 9.0.0 Fixed in 8.2.2 Patch available CNA
- find-my-way (npm) Vendor— Affected 5.5.0 to before 8.2.2 Fixed in 8.2.2 Patch available GHSA-rrr8-f88r-h8q6
- find-my-way (npm) Vendor— Affected 9.0.0 to before 9.0.1 Fixed in 9.0.1 Patch available GHSA-rrr8-f88r-h8q6
Remediation
- Fix · CNA find-my-way (delvedor) Fixed in 8.2.2
- Fix · GHSA-rrr8-f88r-h8q6 find-my-way (npm) Fixed in 8.2.2 Advisory →
- Fix · GHSA-rrr8-f88r-h8q6 find-my-way (npm) Fixed in 9.0.1 Advisory →
Red Hat 5 advisories
- RHSA-2024:11381 Released 2024-12-18 · Red Hat rating ModerateRed Hat Advanced Cluster Management 2.11.4 security enhancements and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 rhacm2/acm-cluster-permission-rhel9, rhacm2/acm-governance-policy-addon-controller-rhel9, rhacm2/acm-governance-policy-framework-addon-rhel9 +40
- RHSA-2024:11293 Released 2024-12-17 · Red Hat rating ModerateMulticluster Engine for Kubernetes 2.6.4 security enhancements and bug fixes
- multicluster engine for Kubernetes 2.6 for RHEL 8 multicluster-engine/assisted-image-service-rhel8, multicluster-engine/assisted-installer-agent-rhel8, multicluster-engine/assisted-installer-controller-rhel8 +2
- multicluster engine for Kubernetes 2.6 for RHEL 9 multicluster-engine/addon-manager-rhel9, multicluster-engine/assisted-service-9-rhel9, multicluster-engine/backplane-rhel9-operator +27
- RHSA-2024:10865 Released 2024-12-05 · Red Hat rating ModerateRed Hat Advanced Cluster Management 2.12.1 bug fixes and container updates
- Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 rhacm2/acm-cli-rhel9, rhacm2/acm-cluster-permission-rhel9, rhacm2/acm-governance-policy-addon-controller-rhel9 +43
Show 2 more Red Hat advisories
- RHSA-2024:10857 Released 2024-12-05 · Red Hat rating ModerateMulticluster Engine for Kubernetes 2.7.2 security updates and bug fixes
- multicluster engine for Kubernetes 2.7 for RHEL 8 multicluster-engine/assisted-service-8-rhel8
- multicluster engine for Kubernetes 2.7 for RHEL 9 multicluster-engine/addon-manager-rhel9, multicluster-engine/assisted-image-service-rhel9, multicluster-engine/assisted-installer-agent-rhel9 +31
- RHSA-2024:10236 Released 2024-11-25 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.17.0 release
- Red Hat OpenShift Dev Spaces 3 devspaces/code-rhel8, devspaces/dashboard-rhel8, devspaces/udi-rhel8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | Fixed | RHSA-2024:11381 |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | Fixed | RHSA-2024:10865 |
| Red Hat OpenShift Dev Spaces 3 | Fixed | RHSA-2024:10236 |
| multicluster engine for Kubernetes 2.6 for RHEL 8 | Fixed | RHSA-2024:11293 |
| multicluster engine for Kubernetes 2.6 for RHEL 9 | Fixed | RHSA-2024:11293 |
| multicluster engine for Kubernetes 2.7 for RHEL 8 | Fixed | RHSA-2024:10857 |
| multicluster engine for Kubernetes 2.7 for RHEL 9 | Fixed | RHSA-2024:10857 |
Not affected: 3 products
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Data Science (RHODS)
- Red Hat OpenShift Dev Spaces 3
Timeline
- 2026-10-02 Threatist record created from CVE-2024-45813
- 2026-10-03 Alias added: GHSA-rrr8-f88r-h8q6
References
Advisory 2
Other 6
- https://github.com/delvedor/find-my-way/security/advisories/GHSA-rrr8-f88r-h8q6
- https://github.com/delvedor/find-my-way/commit/5e9e0eb5d8d438e06a185d5e536a896572dd0440
- https://blakeembrey.com/posts/2024-09-web-redos
- https://github.com/delvedor/find-my-way/commit/17fae694dcefc056045da201681c1530f0f80518
- https://github.com/delvedor/find-my-way/commit/66fa03923355b8da1db4ba572d66a4fee4a57cf5
- https://github.com/delvedor/find-my-way
More delvedor vulnerabilities
- TI-2026-34805 find-my-way is Vulnerable to DDoS with HTTP2 CVSS 3.1HIGH 7.5
Sources
- CVE-2024-45813 · CVE Program
- CVE-2024-45813 · NVD
- FIRST EPSS
- GHSA-rrr8-f88r-h8q6 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-45813 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences