Impact
Inefficient regular expression complexity of lowercase() and uppercase() regex could lead to a denial of service attack. With a formed payload 'a' + 'a'.repeat(i) + 'A', only 32 characters payload could take 29443 ms time execution when testing lowercase(). The same issue happens with uppercase().
Patches
v1.5.1
References
huntr.dev report
Regular Expression Denial of Service (ReDoS) and Catastrophic Backtracking
For more information
If you have any questions or comments about this advisory:
vovikhangcdv Analyst
Impact
Inefficient regular expression complexity of
lowercase()anduppercase()regex could lead to a denial of service attack. With a formed payload'a' + 'a'.repeat(i) + 'A', only 32 characters payload could take 29443 ms time execution when testinglowercase(). The same issue happens withuppercase().Patches
v1.5.1
References
huntr.dev report
Regular Expression Denial of Service (ReDoS) and Catastrophic Backtracking
For more information
If you have any questions or comments about this advisory: