CVE-2021-43306: Exponential ReDoS in jquery-validation
Published Jun 1, 2022
·Updated
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method
Affected Software
2 affected componentsFixes available
npm/jquery-validation<1.19.4
1.19.4
Jqueryvalidation Jquery Validation Node.js<1.19.4
Event History
Jun 1, 2022
CVE Published
via MITRE·04:47 PM
Data Sourced
via MITRE·04:47 PM
DescriptionSeverityWeakness
Jun 3, 2022
Advisory Published
via GitHub·12:00 AM
Frequently Asked Questions
1
What is the severity of CVE-2021-43306?
CVE-2021-43306 is considered a moderate severity vulnerability due to its potential to cause Denial of Service via regular expression issues.
2
How do I fix CVE-2021-43306?
To remediate CVE-2021-43306, update the jquery-validation package to version 1.19.4 or later.
3
What type of vulnerability is CVE-2021-43306?
CVE-2021-43306 is classified as an exponential Regular Expression Denial of Service (ReDoS) vulnerability.
4
What software is affected by CVE-2021-43306?
The jquery-validation npm package versions prior to 1.19.4 are affected by CVE-2021-43306.
5
Can CVE-2021-43306 be exploited remotely?
Yes, an attacker can exploit CVE-2021-43306 remotely if they can manipulate input to the vulnerable url2 method.