Repository navigation
·
13 commits
to main
since this release
Immutable
release. Only release title and notes can be modified.
Security Patch: ReDoS in UnusedVariable
Resolves a regular expression denial of service (CWE-1333). Flow variable
names are no longer compiled into regular expressions; the rule counts
literal substrings instead, so crafted Flow metadata cannot stall a scan.
Upgrade if you scan untrusted or third-party Flow metadata.
Reported by @arpitjain099 via a GitHub security advisory. Thank you.
Release tags:
Action: action-v3.7.4
Core: core-v6.19.4
CLI: v6.19.5
VSX: vsx-v3.4.4
Contributors
arpitjain099