CVE-2021-27293

HIGH

7.5

Description

RestSharp < 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTimes. If a server responds with a malicious string, the client using RestSharp will be stuck processing it for an exceedingly long time. Thus the remote server can trigger Denial of Service.

CVE Details

CVSS v3.1 Score7.5

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published7/12/2021

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

restsharp:restsharp

Weaknesses (CWE)

CWE-697

References

https://github.com/restsharp/RestSharp/issues/1556(cve@mitre.org)

https://restsharp.dev/(cve@mitre.org)

https://github.com/restsharp/RestSharp/issues/1556(af854a3a-2127-422b-91ae-364da2661108)

https://restsharp.dev/(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.