CVE-2024-3772 Regular expression denial of service in Pydantic < 2.4.0

2024-04-1501:42:07

CWE-1333

directcyber

github.com

pydantic

denial of service

crafted email

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.5

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

Regular expression denial of service in Pydanic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service via a crafted email string.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:pydantic_project:pydantic:1.0:-:*:*:*:*:*:*"
    ],
    "vendor": "pydantic_project",
    "product": "pydantic",
    "versions": [
      {
        "status": "affected",
        "version": "1.0",
        "lessThan": "1.10.13",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:pydantic_project:pydantic:2.0:*:*:*:*:*:*:*"
    ],
    "vendor": "pydantic_project",
    "product": "pydantic",
    "versions": [
      {
        "status": "affected",
        "version": "2.0"
      }
    ],
    "defaultStatus": "unknown"
  }
]