CVE-2018-25079 — Segmentio is-url index.js redos

Back Back to CVE browser

HIGH

Segmentio is-url index.js redos

Published Feb 4, 2023

7.5

HIGH

CVSS 3.1

EPSS 0.95%

Description

A vulnerability was found in Segmentio is-url up to 1.2.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. Upgrading to version 1.2.3 is able to address this issue. The patch is identified as 149550935c63a98c11f27f694a7c4a9479e53794. It is recommended to upgrade the affected component. VDB-220058 is the identifier assigned to this vulnerability.

Affected products

Vendor Segmentio Product IS-Url Default
n/a
- Version
  1.2.0
  Status
  affected
  Constraints
  -
- Version
  1.2.1
  Status
  affected
  Constraints
  -
- Version
  1.2.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Segmentio

IS-Url

n/a

Version	Status	Constraints
1.2.0	affected	-
1.2.1	affected	-
1.2.2	affected	-

Red Hat OpenShift Container Platform 3.11

openshift3/ose-console

Out of support scope
Red Hat OpenShift Container Platform 4

openshift4/ose-console

Affected

Product	Package	State	Advisory
Red Hat OpenShift Container Platform 3.11	openshift3/ose-console	Out of support scope	n/a
Red Hat OpenShift Container Platform 4	openshift4/ose-console	Affected	n/a

Ecosystem	Package	Introduced	Fixed
npm	is-url	0	1.2.3

Remediation

No remediation recorded yet.

Metrics

0.95% 0.00951

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00951

Score over time

2023–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (13 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.95% (0.00951)	59.89th	v5 (v2026.06.15)
Jun 15, 2026	0.94% (0.00944)	56.25th	v5 (v2026.06.15)
Mar 17, 2025	0.04% (0.00045)	11.09th	v4 (v2025.03.14)
Dec 12, 2024	0.19% (0.00190)	57.72th	v3 (v2023.03.01)
Jul 17, 2024	0.16% (0.00159)	52.77th	v3 (v2023.03.01)
May 11, 2024	0.13% (0.00133)	48.19th	v3 (v2023.03.01)
Mar 8, 2024	0.12% (0.00117)	44.67th	v3 (v2023.03.01)
Feb 11, 2024	0.10% (0.00098)	39.45th	v3 (v2023.03.01)
Jan 4, 2024	0.06% (0.00061)	24.31th	v3 (v2023.03.01)
Mar 7, 2023	0.05% (0.00052)	18.17th	v3 (v2023.03.01)
Mar 6, 2023	1.02% (0.01018)	40.69th	v2 (v2022.01.01)
Feb 14, 2023	1.02% (0.01018)	40.19th	v2 (v2022.01.01)
Feb 4, 2023	0.95% (0.00950)	31.67th	v2 (v2022.01.01)

Weaknesses (1)

CWE-1333

References (10)

https://access.redhat.com/security/cve/CVE-2018-25079
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2167268
Issue Tracking
https://github.com/advisories/GHSA-p9w8-2mpq-49h9
Advisory
https://github.com/segmentio/is-url/commit/149550935c63a98c11f27f694a7c4a9479e53794
patch
https://github.com/segmentio/is-url/pull/18
issue-trackingIssue TrackingPatch
https://github.com/segmentio/is-url/releases/tag/v1.2.3
patchRelease Notes
https://nvd.nist.gov/vuln/detail/CVE-2018-25079
https://vuldb.com/?ctiid.220058
signaturepermissions-requiredPermissions RequiredThird Party Advisory
https://vuldb.com/?id.220058
vdb-entryPermissions RequiredThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2018-25079

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2018-25079		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2167268		Issue Tracking
https://github.com/advisories/GHSA-p9w8-2mpq-49h9		Advisory
https://github.com/segmentio/is-url/commit/149550935c63a98c11f27f694a7c4a9479e53794		patch
https://github.com/segmentio/is-url/pull/18		issue-trackingIssue TrackingPatch
https://github.com/segmentio/is-url/releases/tag/v1.2.3		patchRelease Notes
https://nvd.nist.gov/vuln/detail/CVE-2018-25079
https://vuldb.com/?ctiid.220058		signaturepermissions-requiredPermissions RequiredThird Party Advisory
https://vuldb.com/?id.220058		vdb-entryPermissions RequiredThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2018-25079