Skip to main content

Inefficient Regular Expression Complexity

CVE-2019-25102

High
7.5/10

Summary

A vulnerability, which was classified as problematic, was found in simple-markdown versions prior to 0.6.1 and 1.0.0-alpha.0. Affected is an unknown function of the file "simple-markdown.js". The manipulation with the input <<<<<<<<<<:/:/:/:/:/:/:/:/:/:/ leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-1333 - Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References

Advisory Timeline

  • Published