CVE-2023-25166CWE-1333

Regular Expression Denial of Service (ReDoS) Vulnerability

Medium · published February 8, 2023

CVSS v3.1
5.5
EPSS
1%
Percentile
48.6
In the wild
Unconfirmed
What it is

formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00611 · 48.6th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2023-02-08T19:28Z
EPSS history
Timeline
  • 08 FEB 19:28Z
    Regular Expression Denial of Service (ReDoS) Vulnerability
    cvelistv5