Regular expression denial of service in jquery-validation
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 3.4%
exploitation probability
3.4%top 12% of all CVEs
observed exploitation
nono source reports it
The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package "jquery-validation". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
jquery-validation · jquery-validationReferences
https://github.com/jquery-validation/jquery-validation/commit/5d8f29eef363d043a8fec4eb86d42cadb5fa5f7dhttps://github.com/jquery-validation/jquery-validation/pull/2371https://github.com/jquery-validation/jquery-validation/security/advisories/GHSA-jxwx-85vp-gvwmhttps://lists.debian.org/debian-lts-announce/2023/08/msg00040.htmlhttps://security.netapp.com/advisory/ntap-20210219-0005/https://www.npmjs.com/package/jquery-validation