GHSA-fqhp-rhm6-8rrj

Source

https://github.com/advisories/GHSA-fqhp-rhm6-8rrj

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-fqhp-rhm6-8rrj/GHSA-fqhp-rhm6-8rrj.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fqhp-rhm6-8rrj

Aliases

CVE-2023-33289

Withdrawn

2025-03-11T21:55:14Z

Published

2023-06-21T21:30:25Z

Modified

2026-09-10T03:49:54Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Withdrawn Advisory: urlnorm vulnerable to Regular Expression Denial of Service

Details

Withdrawn Advisory

This advisory has been withdrawn because the security impact of the slow printing of URLs has been disputed. This link is maintained to preserve external references.

Original Description

The urlnorm crate through 0.1.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to lib.rs.

Database specific

{
    "cwe_ids":  [
        "CWE-1333"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-06-21T21:58:09Z",
    "nvd_published_at":  "2023-06-21T20:15:10Z",
    "severity":  "HIGH"
}

References

Affected packages

crates.io / urlnorm

Package

Name: urlnorm; View open source insights on deps.dev
Purl: pkg:cargo/urlnorm

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

0.1.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-fqhp-rhm6-8rrj/GHSA-fqhp-rhm6-8rrj.json"