GitHub Advisoryadvisory · NuGet

GHSA-9pq7-rcxv-47vq Incorrect Regular Expression in RestSharp

HIGH Published 2021-07-14 Modified 2021-07-15 Official page ↗
Aliases
CVE-2021-27293
Ecosystem
NuGet
Packages
RestSharp
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-185, CWE-697
Reviewed
2021-07-13

Affected packages

• NuGet RestSharp: < 106.11.8-alpha.0.13 → fixed in 106.11.8-alpha.0.13

Description

RestSharp < 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTimes. If a server responds with a malicious string, the client using RestSharp will be stuck processing it for an exceedingly long time. Thus the remote server can trigger Denial of Service.

Related

Alias · CVE (1)

  • CVE-2021-27293 RestSharp < 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when… vulnerability

Weakness · CWE (2)

  • CWE-185 Incorrect Regular Expression weakness
  • CWE-697 Incorrect Comparison weakness

References