Vulnerability · Published Feb 12, 2023 · Assigned by VulDB

CVE-2020-36661Kong lua-multipart multipart.lua is_header redos

Low 3.5

In plain English

A low-severity regular-expression denial of service in lua-multipart from Kong. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.9%top 39.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Kong lua-multipart 0.5.8-1. It has been declared as problematic. This vulnerability affects the function is_header of the file src/multipart.lua. The manipulation leads to inefficient regular expression complexity. Upgrading to version 0.5.9-1 is able to address this issue. The patch is identified as d632e5df43a2928fd537784a99a79dec288bf01b. It is recommended to upgrade the affected component. VDB-220642 is the identifier assigned to this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
Kong	lua-multipart	0.5.8-1

Weakness: CWE-1333 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

https://vuldb.com/?id.220642 vdb-entry, technical-description
https://vuldb.com/?ctiid.220642 signature, permissions-required
https://github.com/Kong/lua-multipart/pull/34 issue-tracking
https://github.com/Kong/lua-multipart/commit/d632e5df43a2928fd537784a99a79dec288bf01b patch
https://github.com/Kong/lua-multipart/releases/tag/0.5.9-1 patch