Vulnerability · Published May 20, 2022 · Assigned by snyk
CVE-2022-21195Regular Expression Denial of Service (ReDoS)
Medium 5.3
In plain English
A medium-severity security flaw in url-regex. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)1.4%top 28.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
All versions of package url-regex are vulnerable to Regular Expression Denial of Service (ReDoS) which can cause the CPU usage to crash.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | url-regex | no fix listed | GHSA-hg3w-7hj9-m3f7 |
Affected products (as reported)
References
- https://snyk.io/vuln/SNYK-PYTHON-URLREGEX-2347643 x_refsource_MISC
- https://github.com/AlexFlipnote/url_regex/blob/master/url_regex/url_regex.py x_refsource_MISC