Log in Start free

Vulnerability · Published May 2, 2025 · Assigned by VulDB

CVE-2025-4215gorhill uBlock Origin UI 1p-filters.js currentStateChanged redos

Low 3.1

In plain English

A low-severity regular-expression denial of service in uBlock Origin from gorhill. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)0.8%top 43.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in gorhill uBlock Origin up to 1.63.3b16. It has been classified as problematic. Affected is the function currentStateChanged of the file src/js/1p-filters.js of the component UI. The manipulation leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.63.3b17 is able to address this issue. The patch is identified as eaedaf5b10d2f7857c6b77fbf7d4a80681d4d46c. It is recommended to upgrade the affected component.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ublock-origin1.62.0+dfsg-0+deb12u1DEBIAN-CVE-2025-4215
Debian:13ublock-origin1.62.0+dfsg-2DEBIAN-CVE-2025-4215
Debian:14ublock-origin1.62.0+dfsg-2DEBIAN-CVE-2025-4215
Ubuntu:22.04:LTSublock-originno fix listedUBUNTU-CVE-2025-4215
Ubuntu:24.04:LTSublock-originno fix listedUBUNTU-CVE-2025-4215

Affected products (as reported)

VendorProductVersions
gorhill uBlock Origin 1.63.3b16

Weakness: CWE-1333, CWE-400 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

References