This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Http-cache-semantics | Http-cache-semantics_project | * | 4.1.1 (excluding) |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-agent-service-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-apiserver-network-proxy-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-assisted-image-service-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-assisted-installer-agent-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-assisted-installer-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-assisted-installer-reporter-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-aws-encryption-provider-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-cluster-api-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-cluster-api-provider-agent-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-cluster-api-provider-aws-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-cluster-api-provider-azure-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-cluster-api-provider-kubevirt-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-clusterclaims-controller-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-cluster-curator-controller-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-clusterlifecycle-state-metrics-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-console-mce-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-discovery-operator-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-hive-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-hypershift-addon-operator-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-hypershift-deployment-controller-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-hypershift-operator-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-klusterlet-operator-bundle-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-managedcluster-import-controller-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-managed-serviceaccount-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-multicloud-manager-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-must-gather-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-operator-bundle-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-operator-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-placement-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-provider-credential-controller-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-registration-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-registration-operator-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-work-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-agent-service-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-apiserver-network-proxy-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-assisted-image-service-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-assisted-installer-agent-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-assisted-installer-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-assisted-installer-reporter-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-aws-encryption-provider-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-cluster-api-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-cluster-api-provider-agent-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-cluster-api-provider-aws-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-cluster-api-provider-azure-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-cluster-api-provider-kubevirt-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-clusterclaims-controller-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-cluster-curator-controller-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-clusterlifecycle-state-metrics-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-cluster-proxy-addon-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-cluster-proxy-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-console-mce-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-discovery-operator-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-hive-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-hypershift-addon-operator-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-hypershift-deployment-controller-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-hypershift-operator-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-klusterlet-operator-bundle-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-managedcluster-import-controller-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-managed-serviceaccount-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-multicloud-manager-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-must-gather-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-operator-bundle-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-operator-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-placement-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-provider-credential-controller-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-registration-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-registration-operator-container | * |
| Multicluster Engine for Kubernetes | RedHat | multicluster-engine-work-container | * |
| Multicluster engine for Kubernetes 2.2 for RHEL 8 | RedHat | multicluster-engine/console-mce-rhel8:v2.2.3-13 | * |
| Multicluster engine for Kubernetes 2.2 for RHEL 8 | RedHat | multicluster-engine/multicluster-engine-console-mce-rhel8:v2.2.3-13 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | acm-cluster-proxy-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | acm-governance-policy-addon-controller-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | acm-grafana-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | acm-must-gather-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | acm-operator-bundle-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | acm-prometheus-config-reloader-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | acm-prometheus-operator-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | acm-volsync-addon-controller-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | cert-policy-controller-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | cluster-backup-operator-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | cluster-proxy-addon-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | config-policy-controller-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | console-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | endpoint-monitoring-operator-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | governance-policy-propagator-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | governance-policy-spec-sync-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | governance-policy-status-sync-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | governance-policy-template-sync-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | grafana-dashboard-loader-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | iam-policy-controller-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | insights-client-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | insights-metrics-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | klusterlet-addon-controller-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | klusterlet-addon-operator-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | kube-rbac-proxy-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | kube-state-metrics-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | management-ingress-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | memcached-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | memcached-exporter-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | metrics-collector-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | multicloud-integrations-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | multiclusterhub-operator-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | multiclusterhub-repo-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | multicluster-observability-operator-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | multicluster-operators-application-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | multicluster-operators-channel-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | multicluster-operators-subscription-operator-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | node-exporter-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | observatorium-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | observatorium-operator-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | prometheus-alertmanager-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | prometheus-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | rbac-query-proxy-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | redisgraph-tls-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | search-aggregator-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | search-api-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | search-collector-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | search-operator-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | submariner-addon-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | thanos-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | thanos-receive-controller-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | acm-governance-policy-addon-controller-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | acm-grafana-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | acm-must-gather-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | acm-operator-bundle-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | acm-prometheus-config-reloader-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | acm-prometheus-operator-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | acm-volsync-addon-controller-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | cert-policy-controller-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | cluster-backup-operator-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | config-policy-controller-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | console-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | endpoint-monitoring-operator-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | governance-policy-propagator-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | governance-policy-spec-sync-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | governance-policy-status-sync-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | governance-policy-template-sync-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | grafana-dashboard-loader-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | iam-policy-controller-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | insights-client-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | insights-metrics-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | klusterlet-addon-controller-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | kube-rbac-proxy-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | kube-state-metrics-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | management-ingress-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | memcached-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | memcached-exporter-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | metrics-collector-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | multicloud-integrations-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | multiclusterhub-operator-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | multiclusterhub-repo-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | multicluster-observability-operator-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | multicluster-operators-application-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | multicluster-operators-channel-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | multicluster-operators-subscription-operator-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | node-exporter-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | observatorium-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | observatorium-operator-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | prometheus-alertmanager-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | prometheus-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | rbac-query-proxy-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | redisgraph-tls-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | search-aggregator-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | search-api-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | search-collector-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | search-operator-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | submariner-addon-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | thanos-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2 | RedHat | thanos-receive-controller-container | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.7 for RHEL 8 | RedHat | rhacm2/acm-search-v2-api-rhel8:v2.7.3-5 | * |
| Red Hat Advanced Cluster Management for Kubernetes 2.7 for RHEL 8 | RedHat | rhacm2/console-rhel8:v2.7.3-16 | * |
| Red Hat Enterprise Linux 8 | RedHat | nodejs:16-8070020230314140722.bd1311ed | * |
| Red Hat Enterprise Linux 8 | RedHat | nodejs:18-8070020230322080930.bd1311ed | * |
| Red Hat Enterprise Linux 8 | RedHat | nodejs:14-8070020230306170042.bd1311ed | * |
| Red Hat Enterprise Linux 8.4 Extended Update Support | RedHat | nodejs:14-8040020230306170312.522a0ee4 | * |
| Red Hat Enterprise Linux 8.6 Extended Update Support | RedHat | nodejs:14-8060020230306170237.ad008a3a | * |
| Red Hat Enterprise Linux 9 | RedHat | nodejs:18-9020020230327152102.rhel9 | * |
| Red Hat Enterprise Linux 9 | RedHat | nodejs-1:16.19.1-1.el9_2 | * |
| Red Hat Enterprise Linux 9.0 Extended Update Support | RedHat | nodejs-1:16.20.2-1.el9_0 | * |
| Red Hat Migration Toolkit for Containers 1.7 | RedHat | rhmtc/openshift-migration-ui-rhel8:v1.7.8-5 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nodejs14-0:3.6-2.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nodejs14-nodejs-0:14.21.3-2.el7 | * |
| RHINT Service Registry 2.4.3 GA | RedHat | http-cache-semantics | * |
Attackers can create crafted inputs that
intentionally cause the regular expression to use
excessive backtracking in a way that causes the CPU
consumption to spike.