CVE-2021-43307 MEDIUM

CVE-2021-43307: Exponential ReDoS in semver-regex

Vendor Semver-Regex
Product semver-regex
Weakness CWE-1333
Published June 1, 2022
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

5.9/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method

Key dates

02Disclosure timeline

June 1, 2022 CVE published
September 17, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-34939 PraisonAI: ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools() CVE-2026-41848 Spring Framework Denial of Service via AntPathMatcher CVE-2026-45409 Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix CVE-2026-40319 Giskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching Check CVE-2026-11478 kokke tiny-regex-c Pattern re.c matchstar redos