High, CVSS 7.5crates.ioPublished
Rust's regex crate vulnerable to regular expression denial of service
CVE-2022-24713 · GHSA-m5pq-gvj9-9vr8
- Affected
- crates.io regex < 1.5.5
- Fixed in
- 1.5.5· Vendor fix available
- Issue
- This is a cross-post of [the official security advisory][advisory]. The official advisory contains a signed version with our PGP key, as well. [advisory]: https://groups.google.com/g/rustlang-security-announcements/c/NcNNL1Jq7Yw The Rust Security Response WG was notified that the regex crate did not properly limit the complexity of the regular expressions (regex) it parses. An attacker could use this security issue to perform a denial of service, by sending a specially crafted regex to a service accepting untrusted regexes. No known vulnerability is present when parsing untrusted input with trusted regexes. This issue has been assigned CVE-2022-24713. The severity of this vulnerability is "high" when the regex crate is used to parse untrusted regexes. Other uses of the regex crate are not affected by this vulnerability. Overview The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted…
Recommended action: Upgrade to 1.5.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.