validator.js is vulnerable to Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Validator | Validator_project | * | 13.7.0 (excluding) |
| RHODF-4.12-RHEL-8 | RedHat | odf4/mcg-core-rhel8:v4.12.10-2 | * |
| RHODF-4.13-RHEL-9 | RedHat | odf4/mcg-core-rhel9:v4.13.0-41 | * |
| Validator.js | Ubuntu | bionic | * |
| Validator.js | Ubuntu | trusty | * |
| Validator.js | Ubuntu | xenial | * |
Attackers can create crafted inputs that
intentionally cause the regular expression to use
excessive backtracking in a way that causes the CPU
consumption to spike.