CVE-2021-27290

ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P

EPSS

4.72% chance of exploitation in the next 30 days, 92nd percentile

Published

2021-03-12

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf

Security advisories

• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• yetingli/SaveResults/blob/main/pdf/ssri-redos.pdf
• https://www.oracle.com/security-alerts/cpuoct2021.html
• advisories/GHSA-vx3p-948g-6vhq
• https://npmjs.com

References

• CVE Record
• NVD entry