CVE-2018-25061 — rgb2hex redos

Back Back to CVE browser

HIGH

rgb2hex redos

Published Dec 31, 2022

7.5

HIGH

CVSS 3.1

EPSS 0.95%

Description

A vulnerability was found in rgb2hex up to 0.1.5. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to inefficient regular expression complexity. The attack may be initiated remotely. Upgrading to version 0.1.6 is able to address this issue. The patch is named 9e0c38594432edfa64136fdf7bb651835e17c34f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217151.

Affected products

Vendor n/a Product Rgb2hex Default
n/a
- Version
  0.1.0
  Status
  affected
  Constraints
  -
- Version
  0.1.1
  Status
  affected
  Constraints
  -
- Version
  0.1.2
  Status
  affected
  Constraints
  -
- Version
  0.1.3
  Status
  affected
  Constraints
  -
- Version
  0.1.4
  Status
  affected
  Constraints
  -
- Version
  0.1.5
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Rgb2hex

n/a

Version	Status	Constraints
0.1.0	affected	-
0.1.1	affected	-
0.1.2	affected	-
0.1.3	affected	-
0.1.4	affected	-
0.1.5	affected	-

Ecosystem	Package	Introduced	Fixed
npm	rgb2hex	0	0.1.6

Remediation

No remediation recorded yet.

Metrics

0.95% 0.00948

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.00948

Score over time

2023–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (12 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	0.95% (0.00948)	59.85th	v5 (v2026.06.15)
Jun 15, 2026	0.94% (0.00940)	56.15th	v5 (v2026.06.15)
Mar 17, 2025	0.04% (0.00043)	10.36th	v4 (v2025.03.14)
Dec 12, 2024	0.15% (0.00154)	53.10th	v3 (v2023.03.01)
Jun 12, 2024	0.13% (0.00129)	48.00th	v3 (v2023.03.01)
Feb 2, 2024	0.12% (0.00117)	45.59th	v3 (v2023.03.01)
Jan 7, 2024	0.10% (0.00098)	40.44th	v3 (v2023.03.01)
Dec 1, 2023	0.06% (0.00061)	24.28th	v3 (v2023.03.01)
Mar 7, 2023	0.05% (0.00052)	18.15th	v3 (v2023.03.01)
Mar 6, 2023	1.02% (0.01018)	40.69th	v2 (v2022.01.01)
Jan 10, 2023	1.02% (0.01018)	39.81th	v2 (v2022.01.01)
Jan 1, 2023	0.95% (0.00950)	31.54th	v2 (v2022.01.01)

Weaknesses (1)

CWE-1333

References (6)

https://github.com/advisories/GHSA-7599-fqgm-v84p
Advisory
https://github.com/christian-bromann/rgb2hex/commit/9e0c38594432edfa64136fdf7bb651835e17c34f
patch
https://github.com/christian-bromann/rgb2hex/releases/tag/v0.1.6
patchRelease Notes
https://nvd.nist.gov/vuln/detail/CVE-2018-25061
https://vuldb.com/?ctiid.217151
signaturepermissions-requiredThird Party Advisory
https://vuldb.com/?id.217151
vdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://github.com/advisories/GHSA-7599-fqgm-v84p		Advisory
https://github.com/christian-bromann/rgb2hex/commit/9e0c38594432edfa64136fdf7bb651835e17c34f		patch
https://github.com/christian-bromann/rgb2hex/releases/tag/v0.1.6		patchRelease Notes
https://nvd.nist.gov/vuln/detail/CVE-2018-25061
https://vuldb.com/?ctiid.217151		signaturepermissions-requiredThird Party Advisory
https://vuldb.com/?id.217151		vdb-entrytechnical-descriptionThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner VulDB

Published Dec 31, 2022

Updated Aug 5, 2024

Reserved Dec 31, 2022

Link CVE-2018-25061

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2018-25061

Red Hat

Severity n/a

Public date n/a

Links CVE-2018-25061

GHSA-7599-FQGM-V84P