CVE-2017-15010

HIGH

tough-cookie < 2.3.3 - Uncontrolled Resource Consumption via ReDoS

Title source: llm

Description

A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.

References (9)

Core 9

Core References

Third Party Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2017:2913

Third Party Advisory x_refsource_confirm

https://nodesecurity.io/advisories/525

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/101185

Third Party Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2018:1264

Third Party Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2017:2912

Third Party Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2018:1263

Issue Tracking, Vendor Advisory x_refsource_confirm

https://github.com/salesforce/tough-cookie/issues/92

Patch, Third Party Advisory x_refsource_confirm

https://snyk.io/vuln/npm:tough-cookie:20170905

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6VEBDTGNHVM677SLZDEHMWOP3ISMZSFT/

Scores

CVSS v3 7.5

EPSS 0.0328

EPSS Percentile 86.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-400

Status published

Products (2)

npm/tough-cookie 0 - 2.3.3npm

salesforce/tough-cookie < 2.3.2

Published Oct 04, 2017

Tracked Since Feb 18, 2026