Skip to content

Potential exponential regex in monitor mode

Low
leibale published GHSA-35q2-47q7-3pc3 Apr 23, 2021

Package

npm redis (npm)

Affected versions

>= 2.6.0 && < 3.1.1

Patched versions

3.1.1

Description

Impact

When a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service.

Patches

The problem was fixed in commit 2d11b6d and was released in version 3.1.1.

References

#1569 (GHSL-2021-026)

Severity

Low

CVE ID

CVE-2021-29469

Weaknesses

No CWEs

Credits