CVE-2024-4148 is a high severity regular expression denial of service in lunary-ai/lunary version 1.2.10. NVD scores it 7.5. A crafted request can slow the application or crash it. Upgrade to a release with the upstream fix commit and add rate limits in front of the API.
What's affected
The record lists lunary version 1.2.10. It describes a request that manipulates regular expressions so that matching takes a very long time and can make the application unavailable. NVD gives the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H: remote, no privileges, high availability impact only.
The record links a fix commit in the lunary repository and a huntr bounty. We did not fetch either, so confirm the release that contains the change in the project release notes.
Weakness class: CWE-1333 (inefficient regular expression complexity).
How to check if you're exposed
If you run lunary yourself, read the version from the container image tag or package file:
docker inspect --format "{.Config.Image}" CONTAINER_NAME
Version 1.2.10 is named in the record. Also check whether the service sits behind a proxy with request timeouts and rate limits. If it does not, one slow request can hold a worker for a long time.
What to do now
- Upgrade lunary to a release containing the fix and confirm it in the notes.
- Put the API behind a reverse proxy with request timeouts and rate limits.
- Run more than one worker so a single stuck request does not take the service down.
- Alert on rising response times and CPU use on the lunary host.
- Review your own code for regular expressions built from user input.
Why it matters
A regular expression denial of service happens when a pattern can match the same text in an enormous number of ways. For some inputs the engine tries each way in turn, and running time grows very quickly with input length. A short crafted string can then occupy a CPU for seconds or minutes.
There is no data theft here. The harm is availability, which is why only that impact is scored high. For an observability tool that other applications send events to, an outage can also mean lost telemetry. The KEV flag is false and the record does not claim exploitation in the wild.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory of vulnerability pages for software you already track.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this expose data?
No. The record scores only availability impact as high.
How can I limit the effect before upgrading?
Use request timeouts and rate limits in a proxy in front of the service.
Sources
These are the references listed in the record. We did not fetch them for this draft, so the version and fix details above come from the record alone and the advisory should be checked.
Last reviewed: 19 October 2026.
