Rust: Security advisory for the regex crate (CVE-2022-24713)

[NewsBot]

A new Rust blog post/announcement has been posted!

This is a cross-post of the official security advisory. The official advisory contains a signed version with our PGP key, as well.

The Rust Security Response WG was notified that the regex crate did not properly limit the complexity of the regular expressions (regex) it parses. An attacker could use this security issue to perform a denial of service, by sending a specially crafted regex to a service accepting untrusted regexes. No known vulnerability is present when parsing untrusted input with trusted regexes.

This issue has been assigned CVE-2022-24713. The severity of this vulnerability is "high" when the regex crate is used to parse untrusted regexes. Other uses of the regex crate are not affected by this vulnerability.

Ov...

Get the full details here: Security advisory for the regex crate (CVE-2022-24713) | Rust Blog

[bot]

Corresponding tweet for this thread:

Devtalk

Share link for this tweet.