CVE-2023-26103

Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/denoland/deno/blob/2b247be517d789a37e532849e2e40b724af0918f/ext/http/01_http.js%23L395-L409	Broken Link
https://github.com/denoland/deno/commit/cf06a7c7e672880e1b38598fe445e2c50b4a9d06	Patch
https://github.com/denoland/deno/pull/17722	Patch
https://github.com/denoland/deno/releases/tag/v1.31.0	Release Notes
https://security.snyk.io/vuln/SNYK-RUST-DENO-3315970	Exploit Technical Description Third Party Advisory
https://github.com/denoland/deno/blob/2b247be517d789a37e532849e2e40b724af0918f/ext/http/01_http.js%23L395-L409	Broken Link
https://github.com/denoland/deno/commit/cf06a7c7e672880e1b38598fe445e2c50b4a9d06	Patch
https://github.com/denoland/deno/pull/17722	Patch
https://github.com/denoland/deno/releases/tag/v1.31.0	Release Notes
https://security.snyk.io/vuln/SNYK-RUST-DENO-3315970	Exploit Technical Description Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:50

Type	Values Removed	Values Added
References	~~() https://github.com/denoland/deno/blob/2b247be517d789a37e532849e2e40b724af0918f/ext/http/01_http.js%23L395-L409 - Broken Link~~	() https://github.com/denoland/deno/blob/2b247be517d789a37e532849e2e40b724af0918f/ext/http/01_http.js%23L395-L409 - Broken Link
References	~~() https://github.com/denoland/deno/commit/cf06a7c7e672880e1b38598fe445e2c50b4a9d06 - Patch~~	() https://github.com/denoland/deno/commit/cf06a7c7e672880e1b38598fe445e2c50b4a9d06 - Patch
References	~~() https://github.com/denoland/deno/pull/17722 - Patch~~	() https://github.com/denoland/deno/pull/17722 - Patch
References	~~() https://github.com/denoland/deno/releases/tag/v1.31.0 - Release Notes~~	() https://github.com/denoland/deno/releases/tag/v1.31.0 - Release Notes
References	~~() https://security.snyk.io/vuln/SNYK-RUST-DENO-3315970 - Exploit, Technical Description, Third Party Advisory~~	() https://security.snyk.io/vuln/SNYK-RUST-DENO-3315970 - Exploit, Technical Description, Third Party Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~7.5~~	v2 : unknown v3 : 5.3

07 Nov 2023, 04:09

Type	Values Removed	Values Added
Summary	Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s,s/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server.	Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s,s/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server.

Information

Published : 2023-02-25 05:15

Updated : 2024-11-21 07:50

NVD link : CVE-2023-26103

Mitre link : CVE-2023-26103

CVE.ORG link : CVE-2023-26103

JSON object : View

Products Affected

deno

deno

CWE

CWE-1333

Inefficient Regular Expression Complexity

5.3 /10