CVE-2016-10527 Regular Expression Denial of Service in riot-compiler
An attacker can cause a denial of service in applications using riot-compiler by triggering catastrophic backtracking in a regular expression.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-10527?
CVE-2016-10527 is a high-severity denial of service vulnerability in HackerOne riot-compiler node module, published on 31 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The riot-compiler version version 2.3.21 has an issue in a regex (Catastrophic Backtracking) thats make it unusable under certain conditions.
Which versions are affected by CVE-2016-10527?
2 open source packages ship an affected version, including riot-compiler. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
riot-compiler npm | All versions | 2.3.22 |
riot-compiler npm | All versions | 2.3.22 |
Products include Riot.js Riot-Compiler.
How do I fix CVE-2016-10527?
Upgrade riot-compiler to 2.3.22 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2016-10527 being exploited?
There is no known exploitation of CVE-2016-10527 in the wild and no public exploit code.
Sources
Also known as GHSA-pp4v-55vr-9gxh.