Vulnerability Description
A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js. An attacker that is able to provide crafted input to the isEmail(input) function may cause an application to consume an excessive amount of CPU.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Segment | Is-Email | < 1.0.1 |
Related Weaknesses (CWE)
References
- https://github.com/segmentio/is-email/releasesRelease NotesThird Party Advisory
- https://segment.com/docs/release_notes/2021-07-13-cve-2021-36716/Vendor Advisory
- https://github.com/segmentio/is-email/releasesRelease NotesThird Party Advisory
- https://segment.com/docs/release_notes/2021-07-13-cve-2021-36716/Vendor Advisory
FAQ
What is CVE-2021-36716?
CVE-2021-36716 is a vulnerability with a CVSS score of 7.5 (HIGH). A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js. An attacker that is able to provide crafted input to the isEmail(input) function...
How severe is CVE-2021-36716?
CVE-2021-36716 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-36716?
Check the references section above for vendor advisories and patch information. Affected products include: Segment Is-Email.