CVE-2020-36661CWE-1333

Kong lua-multipart multipart.lua is_header redos

Low · published February 12, 2023

CVSS v3.1
3.5
EPSS
1%
Percentile
59.9
In the wild
Unconfirmed
What it is

A vulnerability was found in Kong lua-multipart 0.5.8-1. It has been declared as problematic. This vulnerability affects the function is_header of the file src/multipart.lua. The manipulation leads to inefficient regular expression complexity. Upgrading to version 0.5.9-1 is able to address this issue. The patch is identified as d632e5df43a2928fd537784a99a79dec288bf01b. It is recommended to upgrade the affected component. VDB-220642 is the identifier assigned to this vulnerability.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00920 · 59.9th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2023-02-12T20:31Z
EPSS history
Timeline
  • 12 FEB 20:31Z
    Kong lua-multipart multipart.lua is_header redos
    cvelistv5