CVE-2023-26103

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-26103
Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server.

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/denoland/deno/blob/2b247be517d789a37e532849e2e40b724af0918f/ext/http/01_http.js%23L395-L409 Broken Link
https://github.com/denoland/deno/blob/2b247be517d789a37e532849e2e40b724af0918f/ext/http/01_http.js%23L395-L409 Broken Link
https://github.com/denoland/deno/commit/cf06a7c7e672880e1b38598fe445e2c50b4a9d06 Patch
https://github.com/denoland/deno/commit/cf06a7c7e672880e1b38598fe445e2c50b4a9d06 Patch
https://github.com/denoland/deno/pull/17722 Patch
https://github.com/denoland/deno/pull/17722 Patch
https://github.com/denoland/deno/releases/tag/v1.31.0 Release Notes
https://github.com/denoland/deno/releases/tag/v1.31.0 Release Notes
https://security.snyk.io/vuln/SNYK-RUST-DENO-3315970 Exploit Technical Description Third Party Advisory
https://security.snyk.io/vuln/SNYK-RUST-DENO-3315970 Exploit Technical Description Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:deno:deno:*:*:*:*:*:*:*:*
History

11 Mar 2025, 16:15

Type Values Removed Values Added
References (MISC) https://security.snyk.io/vuln/SNYK-RUST-DENO-3315970 - Exploit, Technical Description, Third Party Advisory () https://security.snyk.io/vuln/SNYK-RUST-DENO-3315970 - Exploit, Technical Description, Third Party Advisory
References (MISC) https://github.com/denoland/deno/commit/cf06a7c7e672880e1b38598fe445e2c50b4a9d06 - Patch () https://github.com/denoland/deno/commit/cf06a7c7e672880e1b38598fe445e2c50b4a9d06 - Patch
References (MISC) https://github.com/denoland/deno/blob/2b247be517d789a37e532849e2e40b724af0918f/ext/http/01_http.js%23L395-L409 - Broken Link () https://github.com/denoland/deno/blob/2b247be517d789a37e532849e2e40b724af0918f/ext/http/01_http.js%23L395-L409 - Broken Link
References (MISC) https://github.com/denoland/deno/pull/17722 - Patch () https://github.com/denoland/deno/pull/17722 - Patch
References (MISC) https://github.com/denoland/deno/releases/tag/v1.31.0 - Release Notes () https://github.com/denoland/deno/releases/tag/v1.31.0 - Release Notes

07 Nov 2023, 04:09

Type Values Removed Values Added
Summary Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server. Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server.
Information

Published : 2023-02-25 05:15

Updated : 2025-03-11 16:15

NVD link : CVE-2023-26103

Mitre link : CVE-2023-26103

JSON object : View

Products Affected

deno

  • deno
CWE
CWE-1333

Inefficient Regular Expression Complexity