TI-2024-37791 Aliases CVE-2024-57083 GHSA-9rhg-254w-fh9x

A prototype pollution in the component Module.mergeObjects (redoc/bundles/redoc.lib.js:2)…

HIGH 72CWE-1321Published 2025-03-28 · Updated 2025-04-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 5 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.

Summary

A prototype pollution in the component Module.mergeObjects (redoc/bundles/redoc.lib.js:2) of redoc <= 2.2.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00557 46th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial redoc (npm): 2.4.0Red Hat: 5 advisoriesRed Hat: 5 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	redoc (npm)	before 2.4.0	2.4.0	Patch available	GHSA-9rhg-254w-fh9x

— Vendor— Affected all versions Fixed in — No fix listed CNA
redoc (npm) Vendor— Affected before 2.4.0 Fixed in 2.4.0 Patch available GHSA-9rhg-254w-fh9x

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:redocly:redoc::::::::	up to 2.2.0	Vulnerable	Redocly

cpe:2.3:a:redocly:redoc:*:*:*:*:*:*:*:* Versions up to 2.2.0 Vulnerable ·Redocly

Remediation

Fix · GHSA-9rhg-254w-fh9x redoc (npm) Fixed in 2.4.0 Advisory →

Red Hat 5 advisories

RHSA-2025:8274 Released 2025-05-28 · Red Hat rating Important
Errata Advisory for Red Hat OpenShift GitOps v1.14.4 security update
- Red Hat OpenShift GitOps 1.14 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 +7
RHSA-2025:7753 Released 2025-05-15 · Red Hat rating Important
Errata Advisory for Red Hat OpenShift GitOps v1.15.2 security update
- Red Hat OpenShift GitOps 1.15 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-extensions-rhel8, openshift-gitops-1/argocd-rhel8 +7
RHSA-2025:3930 Released 2025-04-15 · Red Hat rating Important
RHACS 4.7 security update
- RHACS 4.7 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-main-rhel8 +9

Show 2 more Red Hat advisories

RHSA-2025:3929 Released 2025-04-15 · Red Hat rating Important
ACS 4.6 enhancement and security update
- RHACS 4.6 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10
RHSA-2025:3928 Released 2025-04-15 · Red Hat rating Important
ACS 4.5 enhancement and security update
- RHACS 4.5 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Integration Camel K 1	Affected	No fix planned: Will not fix
Red Hat build of Apicurio Registry 2	Affected	No fix yet
RHACS 4.5 for RHEL 8	Fixed	RHSA-2025:3928
RHACS 4.6 for RHEL 8	Fixed	RHSA-2025:3929
RHACS 4.7 for RHEL 8	Fixed	RHSA-2025:3930
Red Hat OpenShift GitOps 1.14	Fixed	RHSA-2025:8274
Red Hat OpenShift GitOps 1.15	Fixed	RHSA-2025:7753

Timeline

2026-10-02 Threatist record created from CVE-2024-57083
2026-10-03 Alias added: GHSA-9rhg-254w-fh9x

References

Exploit 1

https://github.com/Redocly/redoc/issues/2499

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-57083

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences