CVE-2024-4067 is a vulnerability in the micromatch NPM package where the braces() function uses a regular expression pattern (.*) that causes excessive backtracking when processing crafted inputs. This leads to a Regular Expression Denial of Service (ReDoS) by consuming excessive CPU resources and potentially causing the application to hang or slow down. Red Hat identified this issue in their OpenShift Service Mesh containers and related products, issuing a security advisory and updates to address it. The vulnerability has a high severity rating by Red Hat with a CVSS v3 base score of 7.5 (Red Hat's scoring) due to the potential for denial of service via resource exhaustion. No active exploits have been reported. Red Hat's advisory notes that mitigation without patching is not currently feasible or stable, emphasizing the need to apply the provided updates.

The vulnerability allows an attacker to cause a denial of service condition by submitting specially crafted input that triggers excessive CPU consumption in the micromatch.braces() function. This can degrade or halt the affected application, impacting availability. There is no impact on confidentiality or integrity. No known exploits in the wild have been reported. The issue affects Red Hat OpenShift Service Mesh containers and related products that include the vulnerable micromatch version.

Red Hat has released security updates for affected products, including Red Hat OpenShift Dev Spaces 3.25.0 and associated container images. Applying these official updates is the recommended remediation. Red Hat states that no effective or stable mitigations exist that meet their criteria, so patching is the primary solution. Users should ensure all relevant errata are applied as per Red Hat guidance. No additional mitigations are advised by the vendor.