1. Home
  2. CVE Database
  3. CVE-2017-16115
HIGH · 7.5

CVE-2017-16115

The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around 10 seconds.

Vulnerability Description

The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around 10 seconds.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH

Affected Products

VendorProductVersions
Timespan ProjectTimespanAll versions

Related Weaknesses (CWE)

CWE-400

References

FAQ

What is CVE-2017-16115?

CVE-2017-16115 is a vulnerability with a CVSS score of 7.5 (HIGH). The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around 10 seconds.

How severe is CVE-2017-16115?

CVE-2017-16115 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-16115?

Check the references section above for vendor advisories and patch information. Affected products include: Timespan Project Timespan.