{"id":"CVE-2021-21252","published":"2021-01-13T00:00:00Z","modified":"2024-08-03T18:09:14Z","title":"Regular expression denial of service in jquery-validation","vendor":"jquery-validation","product":"jquery-validation","tier":"tail","description":{"text":"The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package \"jquery-validation\". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.03575,"percentile":0.89359,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://github.com/jquery-validation/jquery-validation/security/advisories/GHSA-jxwx-85vp-gvwm","tags":[]},{"url":"https://github.com/jquery-validation/jquery-validation/pull/2371","tags":[]},{"url":"https://github.com/jquery-validation/jquery-validation/commit/5d8f29eef363d043a8fec4eb86d42cadb5fa5f7d","tags":[]},{"url":"https://www.npmjs.com/package/jquery-validation","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20210219-0005/","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html","tags":["mailing-list"]}],"priority":{"score":21.6,"factors":[{"name":"EPSS percentile","points":17.87},{"name":"CVSS severity","points":3.71}]},"vendorSlug":"jquery-validation","affectedVersions":[{"vendor":"jquery-validation","product":"jquery-validation","versions":["< 1.19.3"]}],"affected":[{"ecosystem":"npm","package":"jquery-validation","vulnerableRanges":["<1.19.3"],"patched":["1.19.3"],"from":["GHSA-jxwx-85vp-gvwm"],"provenance":"source"},{"ecosystem":"NuGet","package":"jQuery.Validation","vulnerableRanges":["<1.19.3"],"patched":["1.19.3"],"from":["GHSA-jxwx-85vp-gvwm"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-0508","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-jquery-validation-cve-2021-21252","children":[{"from":"CVE-2021-21252","to":"CVE-2022-31147","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/core.js"],"commits":["https://github.com/jquery-validation/jquery-validation/commit/5d8f29eef363d043a8fec4eb86d42cadb5fa5f7d","https://github.com/jquery-validation/jquery-validation/commit/5bbd80d27fc6b607d2f7f106c89522051a9fb0dd"],"basis":"shared function","functions":["extend"]}]}],"packageHistory":[{"cve":"CVE-2021-21252","published":"2021-01-13","fixed":"1.19.3","kev":false},{"cve":"CVE-2021-43306","published":"2022-06-01","fixed":"1.19.4","kev":false,"link":{"from":"CVE-2021-21252","to":"CVE-2021-43306","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:jquery-validation","fromFixed":"1.19.3","toFixed":"1.19.4","daysApart":504}]}},{"cve":"CVE-2022-31147","published":"2022-07-14","fixed":"1.19.5","kev":false},{"cve":"CVE-2025-3573","published":"2025-04-15","fixed":"1.20.0","kev":false}],"package":"npm:jquery-validation"}}