adobe/css-tools · Security
@adobe/css-tools Regular Expression Denial of Service (ReDOS) while Parsing CSS
- GHSA ID
- GHSA-hpx4-r86g-5jrg
- CVE ID
- CVE-2023-26364
- Severity
- medium
- Published
- Updated
- CVSS
- 5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
- CVSS v3
- 5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
Description
Impact
@adobe/css-tools version 4.3.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS.
Patches
The issue has been resolved in 4.3.1.
Workarounds
None
References
N/A
CWEs
- CWE-20 · Improper Input Validation
- CWE-1333 · Inefficient Regular Expression Complexity