N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
rdfjs:n3.js
References 4
https://github.com/rdfjs/N3.js
disclosure@vulncheck.com
https://github.com/rdfjs/N3.js/commit/b1c497fddb02c4772d61916bd2634115f45f424d
disclosure@vulncheck.com
https://github.com/rdfjs/N3.js/pull/760
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/n3-js-before-2.11.1-redos-via-n3lexer-nume…
disclosure@vulncheck.com