CVE-2020-28500 Regular Expression Denial of Service (ReDoS)
Attackers can cause denial of service in applications using Lodash by exploiting inefficient regular expressions in string manipulation functions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-28500?
CVE-2020-28500 is a medium-severity denial of service vulnerability in Oracle Communications Cloud Native Core Policy, published on 15 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Which versions are affected by CVE-2020-28500?
10 open source packages ship an affected version, including lodash-rails, lodash and lodash-es. It affects 19 products.
| Package | Affected | Fixed in |
|---|---|---|
lodash-rails RubyGems | From 4.0.0 | 4.17.21 |
lodash-rails RubyGems | From 4.0.0 | 4.17.21 |
lodash npm | From 4.0.0 | 4.17.21 |
lodash npm | From 4.0.0 | 4.17.21 |
lodash-es npm | From 4.0.0 | 4.17.21 |
lodash-es npm | From 4.0.0 | 4.17.21 |
4 more packages
lodash.trim npm | From 4.0.0 to 4.5.1 | None |
lodash.trim npm | From 4.0.0 to 4.5.1 | None |
lodash.trimend npm | From 4.0.0 to 4.5.1 | None |
lodash.trimend npm | From 4.0.0 to 4.5.1 | None |
Products include Lodash Lodash, Oracle Banking Corporate Lending Process Management, Oracle Banking Credit Facilities Process Management, Oracle Banking Extensibility Workbench, Oracle Banking Supply Chain Finance, Oracle Banking Trade Finance Process Management and 13 more.
How do I fix CVE-2020-28500?
Upgrade lodash-rails to 4.17.21 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-28500 being exploited?
There is no known exploitation of CVE-2020-28500 in the wild and no public exploit code.
Other vulnerabilities in Oracle Communications Cloud Native Core Policy
- CVE-2026-4800 lodash vulnerable to Code Injection via `_.template` imports key names
- CVE-2020-8203 Prototype Pollution in lodash
- CVE-2021-23337 Command Injection
- CVE-2025-13465 Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions
- CVE-2026-2950 lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
All Oracle Communications Cloud Native Core Policy vulnerabilities
Sources
Also known as AZL-44085, DEBIAN-CVE-2020-28500, GHSA-29mw-wpgm-hmr9, ROOT-APP-NPM-CVE-2020-28500, UBUNTU-CVE-2020-28500.