CVE-2020-7755 - Regular Expression Denial of Service (ReDoS)

HIGH

Regular Expression Denial of Service (ReDoS)

Published Oct 27, 2020

7.5

HIGH

CVSS 3.1

EPSS 2.10%

All versions of package dat.gui are vulnerable to Regular Expression Denial of Service (ReDoS) via specifically crafted rgb and rgba values.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Dat.gui

n/a

Version	Status	Constraints
0	affected	<unspecified

Ecosystem	Package	Introduced	Fixed
npm	dat.gui	0	not fixed

No remediation recorded yet.

Weaknesses (1)

CWE-400

Uncontrolled Resource Consumption

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1045		Advisory
https://github.com/advisories/GHSA-chwr-hf3w-c984		Advisory
https://github.com/dataarts/dat.gui/issues/278		x_refsource_MISCExploitThird Party Advisory
https://github.com/dataarts/dat.gui/pull/279
https://nvd.nist.gov/vuln/detail/CVE-2020-7755
https://snyk.io/vuln/SNYK-JS-DATGUI-1016275		x_refsource_MISCThird Party Advisory
https://www.npmjs.com/package/dat.gui