Lucene search
GoogleOSV:GHSA-CHW2-6C7R-37P7HistoryAug 25, 2022 - 12:00 a.m.
uri-template-lite Regular Expression Denial of Service
2022-08-2500:00:27
Google
osv.dev
9
exponential redos
uri-template-lite
npm package
arbitrary input
uri.expand method
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.001
Percentile
40.9%
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the “URI.expand” method.
Related
prion
prion
Design/Logic Flaw
2022-08-24 16:15:00
cve
cve
CVE-2021-43309
2022-08-24 16:15:09
nvd
nvd
CVE-2021-43309
2022-08-24 16:15:09
cvelist
cvelist
CVE-2021-43309 ReDoS in uri-template-lite URI.expand function
2022-08-24 15:48:36
veracode
veracode
Regular Expression Denial Of Service (ReDoS)
2022-08-25 04:18:20
github
github
uri-template-lite Regular Expression Denial of Service
2022-08-25 00:00:27
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.001
Percentile
40.9%
Related for OSV:GHSA-CHW2-6C7R-37P7