Skip to main content

Inefficient Regular Expression Complexity

CVE-2022-25758

Severity High
Score 7.5/10

Summary

Versions prior to 0.4.3 of package scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) via the "loadAnnotation()" function, due to the usage of insecure regex.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-1333 - Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Advisory Timeline

  • Published