CVE-2018-19826: Medium severity libsass vulnerability

Published Dec 3, 2018

Updated

DISPUTED In inspect.cpp in LibSass 3.5.5, a high memory footprint caused by an endless loop (containing a Sass::Inspect::operator()(Sass::StringQuoted) stack frame) may cause a Denial of Service via crafted sass input files with stray '&' or '/' characters. NOTE: Upstream comments indicate this issue is closed as "won't fix" and "works as intended" by design.

Affected Software

1 affected component

Sass-lang Libsass=3.5.5

Event History

Dec 3, 2018

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Disputed

07:29 PM

Frequently Asked Questions

What is CVE-2018-19826?

CVE-2018-19826 is a vulnerability in LibSass 3.5.5 that can cause a Denial of Service via crafted sass input files with stray '&' or '/' characters.

What is the severity of CVE-2018-19826?

The severity of CVE-2018-19826 is medium (6.5).

How does CVE-2018-19826 affect LibSass?

CVE-2018-19826 affects LibSass 3.5.5.

How can I fix the CVE-2018-19826 vulnerability?

To fix the CVE-2018-19826 vulnerability, update to a version of LibSass that is not affected by this issue.

Is there any additional information about CVE-2018-19826?

For more information about CVE-2018-19826, refer to the GitHub issue linked in the references.