Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2022-24713— Regular expression denial of service in Rust's regex crate

Quick assessment

Affected
rust-lang regex
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Github regex是用于解析、编译和执行正则表达式的 Rust 库。 regex 存在安全漏洞，该漏洞源于不受信任的regex或由受信任的regex匹配的不受信任的输入引起的拒绝服务攻击。

CVSS 7.5 · High EPSS 14.46% · P96

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-24713

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Regular expression denial of service in Rust's regex crate
Source: CVE Program / CVE List V5
Vulnerability Description
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This guarantee is documented and it's considered part of the crate's API. Unfortunately a bug was discovered in the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing, and it's possible to craft regexes that bypass such mitigations. This makes it possible to perform denial of service attacks by sending specially crafted regexes to services accepting user-controlled, untrusted regexes. All versions of the regex crate before or equal to 1.5.4 are affected by this issue. The fix is include starting from regex 1.5.5. All users accepting user-controlled regexes are recommended to upgrade immediately to the latest version of the regex crate. Unfortunately there is no fixed set of problematic regexes, as there are practically infinite regexes that could be crafted to exploit this vulnerability. Because of this, it us not recommend to deny known problematic regexes.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Vulnerability Title
Github regex 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Github regex是用于解析、编译和执行正则表达式的 Rust 库。 regex 存在安全漏洞，该漏洞源于不受信任的regex或由受信任的regex匹配的不受信任的输入引起的拒绝服务攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
rust-lang regex < 1.5.5 -

II. Public POCs for CVE-2022-24713

# POC Description Source Link Shenlong Link
1 Proof of Concept/Test for CVE-2022-24713 on Ubuntu https://github.com/ItzSwirlz/CVE-2022-24713-POC POC Details
2 Proof of Concept/Test for CVE-2022-24713 on Ubuntu https://github.com/JPeisach/CVE-2022-24713-POC POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-24713

请登录查看更多情报信息。

Patches & Fixes for CVE-2022-24713 (1)

Vendor Advisories for CVE-2022-24713 (5)

Mailing List Discussions for CVE-2022-24713 (4)

IV. Related Vulnerabilities

Same vendor: rust-lang
Same weakness: CWE-400

V. Comments for CVE-2022-24713

No comments yet

Leave a comment