CVE-2021-42836 GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ReDoS Vulnerabilities in Microsoft Products Announced Two vulnerabilities related to Regular Expression Denial of Service (ReDoS) have been reported. CVE-2020-28493, published on February 1, 2021, and CVE-2021-42836, published on October 22, 2021, both allow attackers to exploit regular expressions in software, potentially leading to denial of service. Affected products include those utilizing these specific CVEs. 2 sources 36