CVE-2017-16086

ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS Regular Expression Denial of Service attack when given a specially crafted UserAgent header...

CVE-2017-16086

CVE-2017-16086 affects the ua-parser-js module (ua-parser) and can be triggered by a specially crafted User-Agent header, causing a Regular Expression Denial of Service (ReDoS). The vulnerability is documented with a CVSS v3.0 base score of 7.5 (HIGH) and visible in NVD; a prior v2.0 score is 5.0...

CVE-2018-3738

protobufjs is affected by a Denial of Service via a regular expression denial of service when parsing crafted invalid .proto files. Affected versions are prior to 5.0.3 and prior to 6.8.6. Remediation: upgrade to protobufjs 5.0.3 or later, or 6.8.6 or later. The issue arises from ReDoS during par...

CVE-2017-16086

ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS Regular Expression Denial of Service attack when given a specially crafted UserAgent header...

CVE-2017-16098

charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds. Unless node was compiled using the -DHTTPMAXHEADERSIZE= option the default header max length is 80kb, so the impact of the ReDoS is...

CVE-2018-3738

protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files...

CVE-2018-3737

CVE-2018-3737 is a ReDoS vulnerability in the sshpk module when parsing crafted invalid public keys. Connected docs identify this issue as nodejs-sshpk (SSH public-key parsing) referenced in MiracleLinux AXSA-2020-200:01, noting the vulnerability in lib/formats/ssh.js. The Initial Description alr...

CVE-2018-3737

sshpk is vulnerable to ReDoS when parsing crafted invalid public keys...

CVE-2018-3737

sshpk is vulnerable to ReDoS when parsing crafted invalid public keys...

CVE-2017-16086: Uncontrolled Resource Consumption

ua-parser is a port of Browserscope's user agent parser. ua-parser is vulnerable to a ReDoS Regular Expression Denial of Service attack when given a specially crafted UserAgent header...

CVE-2017-16113: Uncontrolled Resource Consumption

The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed...

CVE-2017-16136: Uncontrolled Resource Consumption

method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesn't support it. method-override is vulnerable to a regular expression denial of service vulnerability when specially crafted input is passed in to be parsed...

CVE-2018-3738: Allocation of Resources Without Limits or Throttling

protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files...

CVE-2018-3737: Allocation of Resources Without Limits or Throttling

sshpk is vulnerable to ReDoS when parsing crafted invalid public keys...

CVE-2017-16137: Uncontrolled Resource Consumption

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue...

CVE-2017-16098: Uncontrolled Resource Consumption

charset 1.0.0 and below are vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds. Unless node was compiled using the -DHTTPMAXHEADERSIZE= option the default header max length is 80kb, so the impact of the ReDoS is...

PT-2018-6115

Name of the Vulnerable Software and Affected Versions: ua-parser affected versions not specified Description: The issue concerns a ReDoS Regular Expression Denial of Service attack. When given a specially crafted User-Agent header, ua-parser is vulnerable to this type of attack. Recommendations: ...

CVE-2017-16021

The CVE-2017-16021 issue affects uri-js up to v2.1.1 where a RegExp-based URL validation can cause a Denial of Service (high CPU usage) when processing user input via parse(). Fedora/Nessus/OpenVAS entries reference CVE-2017-16021 and indicate to update to a newer nodejs-uri-js release to fix the...

CVE-2017-16021

uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100%...

CVE-2017-16021: Uncontrolled Resource Consumption

uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100%...