Skip to main content

Inefficient Regular Expression Complexity


Severity High
Score 7.5/10


In mozilla-bleach prior to version 3.1.4, the "bleach.clean" behavior parsing style attributes could result in a Regular expression Denial of Service (ReDoS). Calls to "bleach.clean" with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, "bleach.clean(..., attributes={'a': ['style']})".

  • LOW
  • NONE
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-1333 - Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Advisory Timeline

  • Published