GitHub Advisoryadvisory · crates.io

GHSA-jc97-h3h9-7xh6 Regular Expression Denial of Service in Deno.upgradeWebSocket API

MEDIUM Published 2023-04-03 Modified 2023-04-03 Official page ↗
Aliases
CVE-2023-26103
Ecosystem
crates.io
Packages
deno
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-1333
Reviewed
2023-04-03

Affected packages

• crates.io deno: >= 1.12.0, < 1.31.0 → fixed in 1.31.0

Description

Impact Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server. Patches It is recommended that users upgrade to Deno 1.31.0.

Related

Alias · CVE (1)

  • CVE-2023-26103 Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket… vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References