CVE-2024-21490 is a ReDoS vulnerability affecting angular starting from version 1.3.0. The vulnerability is due to a regular expression used in processing the ng-srcset directive that can exhibit super-linear runtime behavior caused by backtracking. An attacker can supply large, carefully crafted input to trigger catastrophic backtracking, resulting in denial of service. The angular package is no longer maintained and will not receive a fix for this issue. Migration to the supported @angular/core package is recommended.

An attacker can cause a denial of service by exploiting the vulnerable regular expression, leading to excessive CPU consumption and application unavailability. There is no impact on confidentiality or integrity. The vulnerability has a CVSS 3.1 score of 7.5 (high severity), indicating a significant availability impact without requiring privileges or user interaction.

No official patch or fix is available because the angular package is end-of-life and will not receive updates. The recommended mitigation is to migrate applications from angular to the actively maintained @angular/core package. Until migration is complete, avoid processing untrusted input in the ng-srcset directive or implement input validation to limit input size and complexity.