CVE-2020-26302
HIGH WAF: Medium
CVSS 7.5
Published: 2022-12-22
CWE-400
is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). is.js uses a regex copy-pasted from a gist to validate URLs. Trying to validate a malicious string can cause the regex to loop “forever." This vulnerability was found using a CodeQL query which identifies inefficient regular expressions. is.js has no patch for this issue.
WAF Coverage Analysis
Uncontrolled Resource Consumption
Medium WAF Coverage
OWASP: A05:2021 Security Misconfiguration
912xxx - DOS Protection
Affected Software
| Vendor | Product | Version |
|---|---|---|
| is.js_project | is.js | up to 0.9.0 |
References
- github.com (Issue Tracking, Third Party Advisory)
- securitylab.github.com (Exploit, Third Party Advisory)