GitHub Advisoryadvisory · npm, Maven

GHSA-rc47-6667-2j5j http-cache-semantics vulnerable to Regular Expression Denial of Service

HIGH Published 2023-01-31 Modified 2025-02-13 Official page ↗
Aliases
CVE-2022-25881
Ecosystem
npm, Maven
Packages
http-cache-semantics, org.webjars.npm:http-cache-semantics
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333
Reviewed
2023-02-01

Affected packages

• npm http-cache-semantics: < 4.1.1 → fixed in 4.1.1 • Maven org.webjars.npm:http-cache-semantics: < 4.1.1 → fixed in 4.1.1

Description

http-cache semantics contains an Inefficient Regular Expression Complexity , leading to Denial of Service. This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

Related

Alias · CVE (1)

  • CVE-2022-25881 This affects versions of the package http-cache-semantics before 4.1.1. vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References