CVE-2017-16114: High severity marked project vulnerability
Affected versions of marked are vulnerable to a regular expression denial of service.
The amplification in this vulnerability is significant, with 1,000 characters resulting in the event loop being blocked for around 6 seconds.
Recommendation
Update to version 0.3.9 or later.
Other sources
The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-16114?
CVE-2017-16114 is classified as a moderate severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2017-16114?
To resolve CVE-2017-16114, update the marked package to version 0.3.9 or later.
What software is affected by CVE-2017-16114?
CVE-2017-16114 affects versions of the marked package prior to 0.3.9.
What type of vulnerability is CVE-2017-16114?
CVE-2017-16114 is a regular expression denial of service vulnerability.
What is the impact of CVE-2017-16114?
The impact of CVE-2017-16114 includes significant event loop blockage, causing delays in application processing.