CVE-2017-18361

HIGH

Colander < 1.6 - Denial of Service via URL Validator Infinite Loop

Title source: llm

Description

In Pylons Colander through 1.6, the URL validator allows an attacker to potentially cause an infinite loop thereby causing a denial of service via an unclosed parenthesis.

References (2)

Core 2

Core References

Patch, Third Party Advisory x_refsource_misc

https://github.com/Pylons/colander/pull/323

Exploit, Issue Tracking, Third Party Advisory x_refsource_misc

https://github.com/Pylons/colander/issues/290

Scores

CVSS v3 7.5

EPSS 0.0176

EPSS Percentile 75.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-835

Status published

Products (2)

pylonsproject/colander < 1.6

pypi/colander 0 - 1.7.0PyPI

Published Feb 01, 2019

Tracked Since Feb 18, 2026