CVE-2024-10955 is a vulnerability classified under CWE-1333, involving inefficient regular expression complexity in the gaizhenbiao/chuanhuchatgpt project. The affected software uses the regex pattern `<[^>]+>` to parse user input, which in Python's default regex engine can exhibit polynomial time complexity for certain crafted inputs. This inefficiency can be exploited by an attacker who uploads a malicious JSON payload containing strings designed to trigger catastrophic backtracking in the regex engine. As a result, the server's CPU usage spikes to 100%, causing a Denial of Service (DoS) by exhausting processing resources and potentially making the service unavailable. The vulnerability requires network access and low privileges but does not need user interaction, increasing its risk profile. The CVSS 3.0 score is 6.5, reflecting medium severity due to the impact on availability and ease of exploitation. No patches or fixes are currently linked, and no known exploits have been reported in the wild. This vulnerability highlights the risks of using inefficient regex patterns in input parsing, especially in network-facing services. Organizations relying on gaizhenbiao/chuanhuchatgpt or similar Python-based regex parsing should review their regex usage and consider mitigations to prevent DoS attacks.

For European organizations, the primary impact of CVE-2024-10955 is service disruption due to Denial of Service attacks. Organizations running gaizhenbiao/chuanhuchatgpt or similar Python-based applications that parse user input with vulnerable regex patterns may experience server outages or degraded performance. This can affect availability of critical services, leading to operational downtime, loss of productivity, and potential reputational damage. Sectors with high reliance on chatbots or AI-driven communication tools, such as customer support, healthcare, and finance, could be particularly affected. Additionally, the increased CPU usage could lead to higher operational costs and strain on infrastructure. While confidentiality and integrity are not directly impacted, the availability disruption can indirectly affect business continuity and compliance with regulations such as GDPR if services become unavailable. The lack of known exploits in the wild reduces immediate risk but does not eliminate the threat, especially as attackers often weaponize such vulnerabilities once disclosed.

1. Replace the vulnerable regex pattern `<[^>]+>` with a more efficient and safe alternative that avoids catastrophic backtracking, such as using non-greedy quantifiers or specialized parsers for HTML/XML content. 2. Implement strict input validation and sanitization to reject or limit inputs that could trigger regex inefficiencies. 3. Apply resource limits on CPU usage and execution time for regex operations to prevent excessive resource consumption. 4. Monitor server CPU usage and set up alerts for unusual spikes that could indicate exploitation attempts. 5. If possible, update or patch the gaizhenbiao/chuanhuchatgpt project once a fix is released by the vendor or community. 6. Consider isolating the vulnerable service in a sandboxed environment to limit impact. 7. Conduct regular code reviews focusing on regex usage and performance to identify and remediate similar issues proactively. 8. Employ Web Application Firewalls (WAFs) or Intrusion Detection Systems (IDS) to detect and block malicious payloads targeting regex vulnerabilities.