CKEditor 4 ReDoS Vulnerability

published 2021-01-26 5 y ago modified 2026-09-10 1 mo ago also GHSA-jv4c-7jqq-m34x , EUVD-2022-4431

cvss: 6.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.0%; EPSS 2.0% chance of exploitation in 30 days, percentile 80%
public exploits: 0; none known

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).

Patch / fix

fixed in 5 distros 1 links 2

npm ckeditor4-dev 4.16
ckeditor ckeditor 4.16
oracle application_express 21.1.0
oracle jd_edwards_enterpriseone_tools 9.2.6.0
oracle siebel_ui_framework 21.9

ckeditor Debian 12 4.16.0+dfsg-1

debian advisories DEBIAN-CVE-2021-26271

oracle.com//security-alerts/cpujul2021.html advisory
oracle.com/security-alerts/cpuoct2021.html advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-26271 updated 2026-06-26 cvss 4.7

ckeditor: Regular expression denial of service via crafted text into the Styles input

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.99% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:N/I:N/A:P
GitHub	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	ckeditor4-dev	<4.16	4.16

Classification

Weakness

CWE-829 Inclusion of Functionality from Untrusted Control Sphere
CWE-1333 Inefficient Regular Expression Complexity

References

oracle.com //security-alerts/cpujul2021.html
web, patch, third-party-advisory
oracle.com /security-alerts/cpuoct2021.html
web, patch, third-party-advisory
ckeditor.com /blog/CKEditor-4.16-with-improved-image-pasting-High-Contrast-support-and-a-new-color-API/#security-comes-firs
vendor-advisory
github.com /ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-416
web, release-notes, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2021-26271
advisory
github.com /ckeditor/ckeditor4
package
web.archive.org /web/20210128132707/https://ckeditor.com/blog/CKEditor-4.16-with-improved-image-pasting-High-Contrast-support-
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary