Regular Expression Denial Of Service (ReDoS)

mime is vulnerable to regular expression denial of service ReDoS attacks. The library does not restrict the type of characters that it takes in, causing the application to take a long time to process. A malicious user can use this behaviour to cause a ReDoS...

Regular Expression Denial Of Service (ReDoS)

slug is vulnerable to regular expression denial of service ReDoS attacks. The library does not limit the type of characters that get parsed, allowing a malicious user to pass a string to the application to cause a ReDoS...

Regular Expression Denial Of Service (ReDoS)

timespan is vulnerable to regular expression denial of service ReDoS attacks. The library does not restrict the type of characters in a timestamp before parsing it, allowing a malicious user to pass a timestamp to cause a ReDoS...

Regular Expression Denial Of Service (ReDoS)

parsejson is vulnerable to regular expression denial of service ReDoS attacks. An attacker can pass a JSON file to the library that when parsed can cause a ReDoS...

Regular Expression Denial Of Service (ReDoS)

debug is vulnerable to Regular Expression Denial Of Service ReDoS. The regular expression is used to map %o to util.inspect can take awhile for long strings, hanging an application...

Regular Expression Denial Of Service (ReDoS)

content is vulnerable to regular expression denial of service ReDoS attacks. Attackers can use malicious content-type or content-disposition headers to trigger the attack since it does not properly handle the OWS parametes in the headers...

Regular Expression Denial Of Service (ReDoS) Via Parsing Cookies

tough-cookie is vulnerable to regular expression denial of service ReDoS attack. The vulnerability exists because the COOKIEPAIR regular expression used to parse the cookies causes unlimited repetitions when matching input characters. By using a large cookie string, attackers can make the process...

Regular Expression Denial Of Service (ReDoS)

struts2-core and xwork-core are vulnerable to regular expression denial of service ReDoS attacks. When the URLValidator is used it is possible to overload the server process through an attacker controlled URL. These attacks are as a result of an incomplete fix for CVE-2017-7672...

Regular Expression Denial Of Service (ReDoS)

Moodle is vulnerable to Regular Expression Denial Of Service ReDoS attacks. The attacks can be triggered because of the use of a non-optimal regular expression in the URLs filter in filter/urltolink/filter.php, causing high CPU consumption during URL conversion...

ReDoS

Overview Affected versions of brace-expansion are vulnerable to a regular expression denial of service condition. Proof of Concept var expand = require'brace-expansion'; expand',,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,\n'; Recommendation...

Regular Expression Denial Of Service (ReDoS)

decamelize is vulnerable to denial of service DoS attacks. These attacks are possible through the regular expression used to identify camel case names. If an attacker uses the | character, they are able to add to the regular expression and consume the CPU...

Regular Expression Denial Of Service (ReDoS)

brace-expansion is vulnerable to regular expression denial of service ReDoS attacks. A malicious user can pass a string containing a large amount of commas to cause the package to hang...

ReDoS via long UserAgent header

Overview Affected versions of ua-parser are vulnerable to regular expression denial of service when given a specially crafted User-Agent header. Recommendation No patch is currently available for this vulnerability. The best mitigation is currently to avoid using this package, using a different,...

DEBIAN-CVE-2016-4055

The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service CPU consumption via a long string, aka a "regular expression Denial of Service ReDoS."...

Design/Logic Flaw

The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service CPU consumption via a long version string, aka a "regular expression denial of service ReDoS."...

CVE-2015-8858

The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service CPU consumption via crafted input in a parse call, aka a "regular expression denial of service ReDoS."...

CVE-2015-8315

The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service CPU consumption via a long version string, aka a "regular expression denial of service ReDoS."...

CVE-2015-8858

CVE-2015-8858 : The vulnerability affects the uglify-js package before 2.6.0 used in Node.js, where a crafted input to parse() can trigger a regular expression denial of service (ReDoS) and cause high CPU usage. Root cause is a flaw in the regular expression handling within the parser. Impact is ...

CVE-2015-8315

The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service CPU consumption via a long version string, aka a "regular expression denial of service ReDoS."...

CVE-2015-8855

The CVE-2015-8855 entry concerns the semver package for Node.js, where versions before 4.3.2 are vulnerable to a regular expression denial of service (ReDoS) via an excessively long version string. Root cause: an error in the regular expression implementation within semver. Impact: potential CPU ...