CVE-2022-24713 in the critical feed json
Regular expression denial of service in Rust's regex crate
published 2022-03-08 4 y ago modified 2026-06-17 4 mo ago also GHSA-m5pq-gvj9-9vr8 , RUSTSEC-2022-0013 , EUVD-2022-1468
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 14.5%
- EPSS 14.5% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This guarantee is documented and it's considered part of the crate's API. Unfortunately a bug was discovered in the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing, and it's possible to craft regexes that bypass such mitigations. This makes it possible to perform denial of service attacks by sending specially crafted regexes to services accepting user-controlled, untrusted regexes. All versions of the regex crate before or equal to 1.5.4 are affected by this issue. The fix is include starting from regex 1.5.5. All users accepting user-controlled regexes are recommended to upgrade immediately to the latest version of the regex crate. Unfortunately there is no fixed set of problematic regexes, as there are practically infinite regexes that could be crafted to exploit this vulnerability. Because of this, it us not recommend to deny known problematic regexes.
Patch / fix
- crates.io regex 1.5.5
- rust-lang regex 1.5.5
- rust-regex Debian 14, Debian 13, Debian 12 1.5.5-1
- firefox-esr Debian 14, Debian 13, Debian 12 91.8.0esr-1
- thunderbird Debian 14, Debian 13, Debian 12 1:91.8.0-1
debian advisories DEBIAN-CVE-2022-24713
- firefox Ubuntu 18.04 LTS 99.0+build2-0ubuntu0.18.04.2
- firefox Ubuntu 20.04 LTS 99.0+build2-0ubuntu0.20.04.2
- firefox Ubuntu 22.04 LTS 1:1snap1-0ubuntu1
- rust-regex Ubuntu 20.04 LTS 1.2.1-3ubuntu0.1
- rust-regex Ubuntu 22.04 LTS 1.5.4-1ubuntu0.1
- thunderbird Ubuntu 18.04 LTS 1:91.8.1+build1-0ubuntu0.18.04.1
- thunderbird Ubuntu 20.04 LTS 1:91.8.1+build1-0ubuntu0.20.04.1
ubuntu advisories UBUNTU-CVE-2022-24713
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- thunderbird RHEL 8 91.8.0-1.el8_5
- thunderbird RHEL 7 91.8.0-1.el7_9
- firefox RHEL 7 91.8.0-1.el7_9
- firefox RHEL 8 91.8.0-1.el8_5
- thunderbird RHEL 8.2 EUS 91.8.0-1.el8_2
- thunderbird RHEL 8.4 EUS 91.8.0-1.el8_4
- thunderbird RHEL 8.1 E4S 91.8.0-1.el8_1
- firefox RHEL 8.4 EUS 91.8.0-1.el8_4
red hat advisories RHSA-2022:1326RHSA-2022:1305RHSA-2022:1301RHSA-2022:1303RHSA-2022:1302RHSA-2022:1284
- afterburn Linux Micro 6.1 5.10.0.git73.b97f772-slfo.1.1_1.1
- afterburn Linux Micro 6.0 5.10.0.git73.b97f772-1.1
- afterburn SLE Micro 5.4, SLE Micro 5.3 5.9.0.git21.a73f509-150400.3.3.1
- afterburn SLE Micro 5.5 5.9.0.git21.a73f509-150500.3.3.1
- afterburn SLE Micro 5.2 5.9.0.git21.a73f509-150300.3.5.1
- sccache SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4, openSUSE Leap 15.5 +1 more 0.4.2~3-150400.3.3.1
- aws-nitro-enclaves-cli SLE Module for Public Cloud 15 SP4, openSUSE Leap 15.4 1.2.2~git0.4ccc639-150400.3.3.1
- sccache SLE Module for Development Tools 15 SP3, openSUSE Leap 15.3 0.3.0~git5.14a4b8b-150300.7.9.1
suse advisories SUSE-SU-2026:23071-1SUSE-SU-2026:22917-1SUSE-SU-2025:3786-1SUSE-SU-2025:3785-1SUSE-SU-2025:3784-1SUSE-SU-2025:3783-1
- firefox-esr openSUSE Tumbleweed 128.5.1-1.1
- kanidm Package Hub 15 SP6, openSUSE Leap 15.6 1.3.3~git0.f075d13-bp156.4.1
- juliaup openSUSE Tumbleweed 1.5.37-2.1
- macchina openSUSE Tumbleweed 6.0.6~git0.c21ce78-2.1
- treefetch openSUSE Tumbleweed 2.0.0~git0.5b3eac1-2.1
- tuigreet openSUSE Tumbleweed 0.7.1-4.1
- cargo-audit openSUSE Tumbleweed 0.16.0~git0.625c965-3.1
- rage-encryption openSUSE Tumbleweed 0.7.1+0-2.1
opensuse advisories openSUSE-SU-2024:14572-1openSUSE-SU-2024:0294-1openSUSE-SU-2024:11913-1openSUSE-SU-2024:11914-1openSUSE-SU-2024:11917-1openSUSE-SU-2024:11918-1
- thunderbird AlmaLinux 8 91.8.0-1.el8_5.alma
- thunderbird AlmaLinux 8 91.8.0-1.el8_5.alma.plus
- firefox AlmaLinux 8 91.8.0-1.el8_5.alma
almalinux advisories ALSA-2022:1301ALSA-2022:1287
- thunderbird Rocky Linux 8 91.8.0-1.el8_5
- firefox Rocky Linux 8 91.8.0-1.el8_5
rocky linux advisories RLSA-2022:1301RLSA-2022:1287
- bat Alpine 3.15 0.18.3-r2
- bat Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 0.21.0-r0
- delta Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 0.13.0-r0
- swayr Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 0.16.1-r0
- firefox Alpine 3.23, Alpine 3.22, Alpine 3.21 +5 more 99.0-r0
- librewolf Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 99.0-r0
- firefox-esr Alpine 3.23, Alpine 3.22, Alpine 3.21 +6 more 91.8.0-r0
- thunderbird Alpine 3.23, Alpine 3.22, Alpine 3.21 +5 more 91.8.0-r0
alpine advisories ALPINE-CVE-2022-24713
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- librsvg2 Azure Linux 3.0 2.58.1-1
- rust Azure Linux 3.0 regex-1.8.4
azure linux advisories AZL-40907AZL-61405
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- firefox Arch Linux 99.0-1
arch linux advisories AVG-2711
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2022-24713 updated cvss 7.5
Mozilla: Denial of Service via complex regular expressions
-
Red Hat Enterprise Linux 6 firefox, thunderbirdaffected: no fix planned “Out of support scope”
-
Red Hat Enterprise Linux AppStream (v. 8) firefox 91.8.0-1.el8_5, thunderbird 91.8.0-1.el8_5fixed: vendor fix RHSA-2022:1287
-
Red Hat Enterprise Linux AppStream E4S (v. 8.1) firefox 91.8.0-1.el8_1, thunderbird 91.8.0-1.el8_1fixed: vendor fix RHSA-2022:1283
-
Red Hat Enterprise Linux AppStream EUS (v. 8.2) firefox 91.8.0-1.el8_2, thunderbird 91.8.0-1.el8_2fixed: vendor fix RHSA-2022:1286
-
Red Hat Enterprise Linux AppStream EUS (v.8.4) firefox 91.8.0-1.el8_4, thunderbird 91.8.0-1.el8_4fixed: vendor fix RHSA-2022:1285
-
Red Hat Enterprise Linux Client (v. 7) firefox 91.8.0-1.el7_9, thunderbird 91.8.0-1.el7_9 Red Hat Enterprise Linux Client Optional (v. 7) firefox 91.8.0-1.el7_9 Red Hat Enterprise Linux Server (v. 7) firefox 91.8.0-1.el7_9 Red Hat Enterprise Linux Server Optional (v. 7) firefox 91.8.0-1.el7_9, thunderbird 91.8.0-1.el7_9 Red Hat Enterprise Linux Workstation (v. 7) firefox 91.8.0-1.el7_9, thunderbird 91.8.0-1.el7_9 Red Hat Enterprise Linux Workstation Optional (v. 7) firefox 91.8.0-1.el7_9fixed: vendor fix RHSA-2022:1284
-
Red Hat Enterprise Linux 9 firefox, firefox-x11, thunderbirdnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
14.46% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | regex | <1.5.5 >=0.0.0-0, <1.5.5 |
1.5.5 |
Affected products
- rust-lang regex
Classification
References
-
github.com
/rust-lang/regex/commit/ae70b41d4f46641dbc45c7a4f87954aea356283e
web, patch, third-party-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/PDOWTHNVGBOP2HN27PUFIGRYNSNDTYRJ/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/JANLZ3JXWJR7FSHE57K66UIZUIJZI67T/
vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/O3YB7CURSG64CIPCDPNMGPE4UU24AB6H/
vendor-advisory
-
debian.org
/security/2022/dsa-5113
vendor-advisory, web, third-party-advisory
-
debian.org
/security/2022/dsa-5118
vendor-advisory, web, third-party-advisory
-
security.gentoo.org
/glsa/202208-08
vendor-advisory, web, third-party-advisory
-
security.gentoo.org
/glsa/202208-14
vendor-advisory, web, third-party-advisory
-
github.com
/rust-lang/regex/security/advisories/GHSA-m5pq-gvj9-9vr8
web, third-party-advisory
-
groups.google.com
/g/rustlang-security-announcements/c/NcNNL1Jq7Yw
web, third-party-advisory
-
lists.debian.org
/debian-lts-announce/2022/04/msg00003.html
mailing-list, web, third-party-advisory
-
lists.debian.org
/debian-lts-announce/2022/04/msg00009.html
mailing-list, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-24713
advisory
-
github.com
/rust-lang/regex
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/JANLZ3JXWJR7FSHE57K66UIZUIJZI67T
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/O3YB7CURSG64CIPCDPNMGPE4UU24AB6H
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/PDOWTHNVGBOP2HN27PUFIGRYNSNDTYRJ
web
-
rustsec.org
/advisories/RUSTSEC-2022-0013.html
web, advisory
-
crates.io
/crates/regex
package
Sources
- CVE List CVE-2022-24713
- GitHub Advisory GHSA-m5pq-gvj9-9vr8
- NVD CVE-2022-24713
- OSV RUSTSEC-2022-0013
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.