{"id":"CVE-2021-43306","published":"2022-06-01T16:47:27Z","modified":"2024-09-16T23:56:26Z","title":"Exponential ReDoS in jquery-validation","vendor":"jquery-validation","product":"jquery-validation","tier":"tail","description":{"text":"An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method","provenance":"source","from":"CVE.org"},"cvss":{"score":5.9,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01523,"percentile":0.74561,"provenance":"source"},"cwes":[{"id":"CWE-1333","name":"Inefficient Regular Expression Complexity"}],"references":[{"url":"https://research.jfrog.com/vulnerabilities/jquery-validation-redos-xray-211348/","tags":["x_refsource_MISC"]}],"priority":{"score":19.0,"factors":[{"name":"EPSS percentile","points":14.91},{"name":"CVSS severity","points":4.13}]},"vendorSlug":"jquery-validation","affectedVersions":[{"vendor":"jquery-validation","product":"jquery-validation","versions":[">= unspecified, < 1.19.4"]}],"affected":[{"ecosystem":"npm","package":"jquery-validation","vulnerableRanges":["<1.19.4"],"patched":["1.19.4"],"from":["GHSA-j9m2-h2pv-wvph"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-6077","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-jquery-validation-cve-2021-21252","children":[{"from":"CVE-2021-43306","to":"CVE-2022-31147","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"This is due to an incomplete fix for CVE-2021-43306.","from":"CVE.org","in":"CVE-2022-31147"},{"kind":"version-step","provenance":"source","package":"npm:jquery-validation","fromFixed":"1.19.4","toFixed":"1.19.5","daysApart":43},{"kind":"same-code","provenance":"machine","files":["src/additional/url2.js"],"commits":["https://github.com/jquery-validation/jquery-validation/commit/69cb17ed774b427f7e2ffcdf197968231725c30e","https://github.com/jquery-validation/jquery-validation/commit/5bbd80d27fc6b607d2f7f106c89522051a9fb0dd"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.7,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2021-21252","published":"2021-01-13","fixed":"1.19.3","kev":false,"link":{"from":"CVE-2021-21252","to":"CVE-2021-43306","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:jquery-validation","fromFixed":"1.19.3","toFixed":"1.19.4","daysApart":504}]}},{"cve":"CVE-2021-43306","published":"2022-06-01","fixed":"1.19.4","kev":false},{"cve":"CVE-2022-31147","published":"2022-07-14","fixed":"1.19.5","kev":false},{"cve":"CVE-2025-3573","published":"2025-04-15","fixed":"1.20.0","kev":false}],"package":"npm:jquery-validation"}}