The urlnorm crate through 0.1.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to lib.rs. NOTE: the Supplier disputes this, taking the position that Slow printing of URLs is not a CVE.
Weakness
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Urlnorm | Urlnorm_project | * | 0.1.4 (including) |
Potential Mitigations
Related Attack Patterns
References
- https://gist.github.com/6en6ar/b118888dc739e8979038f24c8ac33611
- https://github.com/progscrape/urlnorm
- https://lib.rs/crates/urlnorm
- https://news.ycombinator.com/item?id=40435263
- https://gist.github.com/6en6ar/b118888dc739e8979038f24c8ac33611
- https://github.com/progscrape/urlnorm
- https://lib.rs/crates/urlnorm