Skip to content
Log inStart free trial

GHSA-qhv9-728r-6jqg CVE-2016-1000232

ReDoS via long string of semicolons in tough-cookie

Medium npm
Severity
5.3 / 10
Medium · CVSS 3.0
Exploit chance (EPSS)
2.36%
Chance of exploitation in the next 30 days. Higher than 83.75% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-1333 Inefficient Regular Expression Complexity
Fix
2.3.0
Upgrade tough-cookie to this version or later

Description

Affected versions of tough-cookie may be vulnerable to regular expression denial of service when long strings of semicolons exist in the Set-Cookie header.

Recommendation

Update to version 2.3.0 or later.

Affected versions

npm

PackageVulnerableFixed in
tough-cookie
< 2.3.0
2.3.0

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

tough-cookie npm → 2.3.0

npm
npm install tough-cookie@2.3.0
yarn
yarn add tough-cookie@2.3.0
pnpm
pnpm add tough-cookie@2.3.0

Severity breakdown

CVSS 3.0 5.3

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Weakness

CWE-1333: Inefficient Regular Expression Complexity

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

How to prevent it
  • Architecture and Design: Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
  • System Configuration: Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
  • Implementation: Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
  • Implementation: Limit the length of the input that the regular expression will process.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-72xf-g2v4-qvf3
tough-cookie Prototype Pollution vulnerability
Critical Also affects tough-cookie
GHSA-g7q5-pjjr-gqvp
Regular Expression Denial of Service in tough-cookie
High Also affects tough-cookie
GHSA-7wch-p9px-956x
Forge: Regular expression denial of service in PEM decoding (pem.decode)
High Same weakness, CWE-1333
GHSA-xcq7-p3pf-p88h
OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api
Medium Same weakness, CWE-1333
GHSA-xgh8-jp6q-p5x8
Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
High Same weakness, CWE-1333
GHSA-rxp7-6hxx-x8q5
ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
Medium Same weakness, CWE-1333
GHSA-r925-mgvr-h9cc
Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
High Same weakness, CWE-1333
GHSA-4ffr-jq9g-5ffx
Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service
High Same weakness, CWE-1333
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor