CVE-2018-25079 MEDIUM

CVE-2018-25079: Segmentio is-url index.js redos

Vendor Segmentio
Product is-url
Weakness CWE-1333
Published February 4, 2023
Last update August 5, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

A vulnerability was found in Segmentio is-url up to 1.2.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. Upgrading to version 1.2.3 is able to address this issue. The patch is identified as 149550935c63a98c11f27f694a7c4a9479e53794. It is recommended to upgrade the affected component. VDB-220058 is the identifier assigned to this vulnerability.

Key dates

02Disclosure timeline

February 4, 2023 CVE published
August 5, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-4867 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters CVE-2025-66020 Valibot has a ReDoS vulnerability in `EMOJI_REGEX` CVE-2026-45409 Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix CVE-2026-10691 wonderwhy-er DesktopCommanderMCP start_search search-manager.ts redos CVE-2026-0967 Libssh: libssh: denial of service via inefficient regular expression processing