5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-3772

CVE-2024-3772: Pydantic regular expression denial of service

Regular expression denial of service in Pydantic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service via a crafted email string.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-3772

CVE-2024-3772:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pydantic	pip	>= 2.0.0, < 2.4.0	2.4.0
pydantic	pip	< 1.10.13	1.10.13

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a regular expression denial of service (ReDoS) in Pydantic's email validation. The analysis of the provided patches (commits 59d8f38fd6220e3917c53785dbc70317d6f8e631 for Pydantic 1.x and e4393ae6145c4dadff739990bb0116c6dec3441b for Pydantic 2.x) reveals two key functions involved:

pydantic.networks.validate_email: This function is the primary entry point for email string validation. In both Pydantic 1.x and 2.x, it used a regex pattern susceptible to ReDoS. The patches add a maximum length check to this function as a mitigation, indicating that it previously processed potentially malicious long strings with the vulnerable regex. This function directly processes the malicious input.
pydantic.networks._build_pretty_email_regex: This function is specific to Pydantic 2.x and was responsible for generating the vulnerable regex pattern used by validate_email. The patch e4393ae6145c4dadff739990bb0116c6dec3441b directly modifies this function to create a safer, bounded regex. This function contained the definition of the vulnerable regex pattern.

In Pydantic 1.x, the vulnerable regex (re.compile(r'([\\w ]*?) *<(.*)> *')) was defined at the module level and used by validate_email. While not a function, this regex itself was the core issue, and validate_email was the function applying it.

Both identified functions were either processing the malicious input with a vulnerable regex or were responsible for creating the vulnerable regex itself, making them central to the ReDoS vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.