CWE-1333

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "express-zod-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.0.0-beta1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-04T14:46:06Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\n\nAPI servers running `express-zod-api` having:\n\n- version of `express-zod-api` below `10.0.0-beta1`,\n- and using the following (or similar) validation schema in its implementation: `z.string().email()`,\n\nare vulnerable to a DoS attack due to: \n\n- Inefficient Regular Expression Complexity in `zod` versions up to `3.22.2`,\n- depending on `zod`.\n\n### Patches\n\nThe patched version of `zod` fixing the vulnerability is `3.22.3`.\n\nHowever, it\u0027s highly recommended to upgrade `express-zod-api` to at least version `10.0.0`, which does not depend on `zod` strictly and directly, but requires its installation as a peer dependency instead, enabling you to install the patched `zod` version yourself.\n\n### Workarounds\n\nWhen it\u0027s not possible to upgrade your dependencies, consider the following replacement in your implementation:\n\n```diff\n- z.string().email()\n+ z.string().regex(\n+   /^(?!\\.)(?!.*\\.\\.)([A-Z0-9_+-\\.]*)[A-Z0-9_+-]@([A-Z0-9][A-Z0-9\\-]*\\.)+[A-Z]{2,}$/i\n+ )\n```\n\nThis regular expression is taken from the suggested patch of `zod`.\n\n### References\n\n- Original issue: https://github.com/colinhacks/zod/issues/2609\n- The patch: https://github.com/colinhacks/zod/pull/2824\n- Entry in database: https://nvd.nist.gov/vuln/detail/CVE-2023-4316\n- Enumeration: https://cwe.mitre.org/data/definitions/1333.html\n- Parent advisory: https://github.com/advisories/GHSA-m95q-7qp3-xv42\n- Changelog entry for `express-zod-api` version `10.0.0-beta1`: https://github.com/RobinTail/express-zod-api/blob/master/CHANGELOG.md#v1000-beta1",
  "id": "GHSA-mvrp-3cvx-c325",
  "modified": "2023-10-04T14:46:06Z",
  "published": "2023-10-04T14:46:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/RobinTail/express-zod-api/security/advisories/GHSA-mvrp-3cvx-c325"
    },
    {
      "type": "WEB",
      "url": "https://github.com/colinhacks/zod/issues/2609"
    },
    {
      "type": "WEB",
      "url": "https://github.com/colinhacks/zod/pull/2824"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/RobinTail/express-zod-api"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-m95q-7qp3-xv42"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Zod denial of service vulnerability during email validation"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.7.4"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "tecnickcom/tcpdf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.7.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-22640"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-19T19:49:13Z",
    "nvd_published_at": "2024-04-19T16:15:09Z",
    "severity": "MODERATE"
  },
  "details": "TCPDF version \u003c= 6.7.4 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.",
  "id": "GHSA-mx3p-fhpw-x6rv",
  "modified": "2025-11-04T19:45:34Z",
  "published": "2024-04-19T18:31:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22640"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tecnickcom/TCPDF/commit/05f3a28f4a7905019469e040cf77e53d6aa7f679"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tecnickcom/TCPDF"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zunak/CVE-2024-22640"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/06/msg00004.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LIB3R2WB7XPW2I4PGVMZ3VLFLRHOK4RB"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LIB3R2WB7XPW2I4PGVMZ3VLFLRHOK4RB"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "TCPDF vulnerable to Regular Expression Denial of Service"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "predefine"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-28280"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-10-08T22:13:34Z",
    "nvd_published_at": "2020-12-29T18:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Prototype pollution vulnerability in \u0027predefine\u0027 versions 0.0.0 through 0.1.2 allows an attacker to cause a denial of service and may lead to remote code execution.",
  "id": "GHSA-mx3x-ghqm-r43h",
  "modified": "2021-10-08T22:13:34Z",
  "published": "2021-10-12T16:27:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28280"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bigpipe/predefine/commit/1a86a013c0b37c9d6ca078ba34017052af38b7fc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/bigpipe/predefine"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bigpipe/predefine/blob/238137e3d1b8288ff5d7529c3cbcdd371888c26b/index.js#L284"
    },
    {
      "type": "WEB",
      "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28280"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Prototype pollution vulnerability in \u0027predefine\u0027"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "email-existence"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2018-25049"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-30T17:40:18Z",
    "nvd_published_at": "2022-12-27T09:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability was found in email-existence. It has been rated as problematic. Affected by this issue is some unknown functionality of the file `index.js`. The manipulation leads to inefficient regular expression complexity. The name of the patch is 0029ba71b6ad0d8ec0baa2ecc6256d038bdd9b56. It is recommended to apply a patch to fix this issue. VDB-216854 is the identifier assigned to this vulnerability.",
  "id": "GHSA-p27h-4cpf-fw48",
  "modified": "2023-01-10T21:42:08Z",
  "published": "2022-12-27T09:30:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25049"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nmanousos/email-existence/pull/37"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nmanousos/email-existence/commit/0029ba71b6ad0d8ec0baa2ecc6256d038bdd9b56"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nmanousos/email-existence"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.216854"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.216854"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "email-existence Inefficient Regular Expression Complexity vulnerability"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "css-what"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-21222"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333",
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-10-04T21:11:32Z",
    "nvd_published_at": "2022-09-30T05:15:00Z",
    "severity": "HIGH"
  },
  "details": "The package css-what before 2.1.3 is vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of insecure regular expression in the `re_attr` variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.",
  "id": "GHSA-p28h-cc7q-c4fg",
  "modified": "2025-05-20T21:02:33Z",
  "published": "2022-10-01T00:00:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21222"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fb55/css-what/commit/dc510929790da6617e7aa93a616498b22f6a6b72"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fb55/css-what"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fb55/css-what/blob/a38effd5a8f5506d75c7f8f13cbd8c76248a3860/index.js#23L12"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fb55/css-what/blob/a38effd5a8f5506d75c7f8f13cbd8c76248a3860/index.js%23L12"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "https://security.snyk.io/vuln/SNYK-JS-CSSWHAT-3035488"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "css-what vulnerable to ReDoS due to use of insecure regular expression"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "multipart"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.3.0"
            },
            {
              "fixed": "1.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "multipart"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-28356"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-12T18:32:18Z",
    "nvd_published_at": "2026-03-12T17:16:50Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe `parse_options_header()` function in `multipart.py` uses a regular expression with an *ambiguous alternation*, which can cause *exponential backtracking (ReDoS)* when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for **denial of service (DoS)** attacks against web applications using this library to parse request headers or `multipart/form-data` streams.\n\n## Impact\n\nAny WSGI or ASGI application using `multipart.parse_form_data()` directly or indirectly (e.g. while parsing `multipart/form-data` streams) is vulnerable. The slow-down is significant enough to block request handling threads for multiple seconds per request.\n\n## Affected versions\n\nAll versions up to and including `1.3.0` are affected. The issue is fixed in `1.2.2`, `1.3.1` and `1.4.0-dev`.",
  "id": "GHSA-p2m9-wcp5-6qw3",
  "modified": "2026-03-12T18:32:18Z",
  "published": "2026-03-12T18:32:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/defnull/multipart/security/advisories/GHSA-p2m9-wcp5-6qw3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28356"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/defnull/multipart"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "multipart vulnerable to ReDoS in `parse_options_header()`"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "uap-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.11.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-21317"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333",
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-02-01T16:57:05Z",
    "nvd_published_at": "2021-02-16T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "## Impact\n\nSome regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.\n\n## Patches\n\nPlease update uap-core to \u003e= v0.11.0\n\nDownstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes.",
  "id": "GHSA-p4pj-mg4r-x6v4",
  "modified": "2024-02-08T22:17:20Z",
  "published": "2021-02-02T15:46:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ua-parser/uap-core/security/advisories/GHSA-p4pj-mg4r-x6v4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21317"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ua-parser/uap-core/commit/dc9925d458214cfe87b93e35346980612f6ae96c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ua-parser/uap-core"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/package/uap-core"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Denial of Service in uap-core"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/facebookincubator/tacquito"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20241011192817-07b49d1358e6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-18T18:40:32Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\nThe CVE is for a software vulnerability. Network admins who have deployed tacquito (or versions of tacquito) in their production environments and use tacquito to perform command authorization for network devices should be impacted.\n\nTacquito code prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was performing regex matches on authorized commands and arguments in a more permissive than intended manner. Configured allowed commands/arguments were intended to require a match on the entire string, but instead only enforced a match on a sub-string. This behaviour could potentially allowed unauthorized commands to be executed.\n\n### Patches\nThe problem has been patched, and users should update to the latest github repo commit to get the patch. \n\n### Workarounds\nUsers should be able to add boundary conditions anchors \u0027^\u0027 and \u0027$\u0027 to their command configs to remediate the vulnerability without the upgrade\n",
  "id": "GHSA-p5wf-cmr4-xrwr",
  "modified": "2024-11-01T21:47:15Z",
  "published": "2024-10-18T18:40:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/facebookincubator/tacquito/security/advisories/GHSA-p5wf-cmr4-xrwr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49400"
    },
    {
      "type": "WEB",
      "url": "https://github.com/facebookincubator/tacquito/commit/07b49d1358e6ec0b5aa482fcd284f509191119e2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/facebookincubator/tacquito"
    },
    {
      "type": "WEB",
      "url": "https://www.facebook.com/security/advisories/cve-2024-49400"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Permissive Regular Expression in tacquito"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-13926"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-19T06:15:18Z",
    "severity": "HIGH"
  },
  "details": "The WP-Syntax WordPress plugin through 1.2 does not properly handle input, allowing an attacker to create a post containing a large number of tags, thereby exploiting a catastrophic backtracking issue in the regular expression processing to cause a DoS.",
  "id": "GHSA-p6jq-9gcc-mcvx",
  "modified": "2025-04-21T03:30:18Z",
  "published": "2025-04-19T06:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13926"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/b5f0092e-7cd5-412f-a8ea-7bd4a8bf86d2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "Django"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0"
            },
            {
              "fixed": "1.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "Django"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.1"
            },
            {
              "fixed": "1.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2009-3695"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333",
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-08T22:00:20Z",
    "nvd_published_at": "2009-10-13T10:30:00Z",
    "severity": "HIGH"
  },
  "details": "Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.",
  "id": "GHSA-p6m5-h7pp-v2x5",
  "modified": "2024-09-16T21:57:14Z",
  "published": "2022-05-02T03:47:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3695"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django/django/commit/594a28a9044120bed58671dde8a805c9e0f6c79a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django/django/commit/e3e992e18b368fcd56aabafc1b5bf80a6e11b495"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53727"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/django/django"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2009-4.yaml"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20091013093057/http://secunia.com/advisories/36968"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20091017070244/http://secunia.com/advisories/36948"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20200228171918/http://www.securityfocus.com/bid/36655"
    },
    {
      "type": "WEB",
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=550457"
    },
    {
      "type": "WEB",
      "url": "http://groups.google.com/group/django-users/browse_thread/thread/15df9e45118dfc51"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2009/dsa-1905"
    },
    {
      "type": "WEB",
      "url": "http://www.djangoproject.com/weblog/2009/oct/09/security"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2009/10/13/6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Django Regex Algorithmic Complexity Causes Denial of Service"
}