CVE-2023-26103

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-26103
Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/denoland/deno/blob/2b247be517d789a37e532849e2e40b724af0918f/ext/http/01_http.js%23L395-L409 Broken Link
https://github.com/denoland/deno/commit/cf06a7c7e672880e1b38598fe445e2c50b4a9d06 Patch
https://github.com/denoland/deno/pull/17722 Patch
https://github.com/denoland/deno/releases/tag/v1.31.0 Release Notes
https://security.snyk.io/vuln/SNYK-RUST-DENO-3315970 Exploit Technical Description Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*
History

07 Nov 2023, 04:09

Type Values Removed Values Added
Summary Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server. Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server.

07 Mar 2023, 02:48

Type Values Removed Values Added
First Time Deno deno
Deno
CPE cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CWE CWE-1333
References (MISC) https://github.com/denoland/deno/releases/tag/v1.31.0 - (MISC) https://github.com/denoland/deno/releases/tag/v1.31.0 - Release Notes
References (MISC) https://github.com/denoland/deno/commit/cf06a7c7e672880e1b38598fe445e2c50b4a9d06 - (MISC) https://github.com/denoland/deno/commit/cf06a7c7e672880e1b38598fe445e2c50b4a9d06 - Patch
References (MISC) https://github.com/denoland/deno/blob/2b247be517d789a37e532849e2e40b724af0918f/ext/http/01_http.js%23L395-L409 - (MISC) https://github.com/denoland/deno/blob/2b247be517d789a37e532849e2e40b724af0918f/ext/http/01_http.js%23L395-L409 - Broken Link
References (MISC) https://security.snyk.io/vuln/SNYK-RUST-DENO-3315970 - (MISC) https://security.snyk.io/vuln/SNYK-RUST-DENO-3315970 - Exploit, Technical Description, Third Party Advisory
References (MISC) https://github.com/denoland/deno/pull/17722 - (MISC) https://github.com/denoland/deno/pull/17722 - Patch

25 Feb 2023, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-02-25 05:15

Updated : 2023-12-10 14:48

NVD link : CVE-2023-26103

Mitre link : CVE-2023-26103

CVE.ORG link : CVE-2023-26103

JSON object : View

Products Affected

deno

  • deno
CWE
CWE-1333