Regular Expression Denial of Service (ReDoS) in Jinja2
Moderate severity
GitHub Reviewed
Published
Mar 19, 2021
to the GitHub Advisory Database
•
Updated Sep 7, 2023
Description
Published by the National Vulnerability Database
Feb 1, 2021
Reviewed
Mar 13, 2021
Published to the GitHub Advisory Database
Mar 19, 2021
Last updated
Sep 7, 2023
Credits
-
tdunlap607 Analyst
This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDOS vulnerability of the regex is mainly due to the sub-pattern [a-zA-Z0-9.-]+.[a-zA-Z0-9.-]+ This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.
References