CVE-2023-22467
Luxon Inefficient Regular Expression Complexity vulnerability
Description
# Impact Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks. This is the same bug as Moment's https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g # Workarounds Limit the length of the input. # References There is an excellent writeup of the same issue in Moment: https://github.com/moment/moment/pull/6015#issuecomment-1152961973 # Details `DateTime.fromRFC2822("(".repeat(500000))` takes a couple minutes to complete.
How to fix CVE-2023-22467
To remediate CVE-2023-22467, upgrade the affected package to a fixed version below.
- —upgrade to 1.28.1 or later
Is CVE-2023-22467 being exploited?
Low — EPSS is 0.7%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 1.0.0, < 1.28.1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |