Skip to main content

Inefficient Regular Expression Complexity

CVE-2015-10005

High
7.5/10

Summary

A vulnerability was found in markdown-it versions prior to 3.0.0. It has been classified as problematic. The vulnerable regex pattern is present in the "cdata" variable in the "lib/common/html_re.js" file. The manipulation leads to inefficient regular expression complexity. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216852.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-1333 - Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References

Advisory Timeline

  • Published