Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Old Versions of TF2 Item Format Tool Can Crash from Bad Input

CVE-2024-41655 · published 2 years ago
Summary

Old versions of the TF2 item formatting tool can stop working if given bad input, which can be used by an attacker to disrupt a website or service that uses this tool. This affects versions of the tool released before a certain update, and a fix is available in the latest version. Update to the latest version of the tool to fix this issue.

What to do
  • Update danocmx tf2-item-format to version 5.9.14.
Affected software
Ecosystem VendorProductAffected versions
npm danocmx tf2-item-format >= 4.2.6, <= 5.9.13
Fix: upgrade to 5.9.14
Original advisory text
TF2 Item Format Regular Expression Denial of Service vulnerability
TF2 Item Format helps users format TF2 items to the community standards. Versions of `tf2-item-format` since at least `4.2.6` and prior to `5.9.14` are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when parsing crafted user input. This vulnerability can be exploited by an attacker to perform DoS attacks on any service that uses any `tf2-item-format` to parse user input. Version `5.9.14` contains a fix for the issue.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-624Executable Regular Expression Error
CWE-1333Inefficient Regular Expression Complexity (ReDoS)
Timeline
Published23 Jul 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-8h55-q5qq-p685 · GHSA
CVE-2024-41655 · NVD
CVE-2024-41655 · OSV
Track software like this
Free during beta