CVE-2021-27290

HIGH

ssri 5.2.2-8.0.0 - Denial of Service via SRI Processing Regular Expression

Title source: llm
STIX 2.1

Description

ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.

References (5)

Core 5
Core References
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpuoct2021.html
Exploit, Patch, Third Party Advisory x_refsource_misc
https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf
Patch, Third Party Advisory x_refsource_confirm
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Product x_refsource_misc
https://npmjs.com

Scores

CVSS v3 7.5
EPSS 0.0246
EPSS Percentile 85.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

Status published
Products (5)
npm/ssri 5.2.2 - 6.0.2npm
oracle/graalvm 20.3.3
oracle/graalvm 21.2.0
siemens/sinec_infrastructure_network_services < 1.0.1.1
ssri_project/ssri 5.2.2 - 6.0.2
Published Mar 12, 2021
Tracked Since Feb 18, 2026