Skip to content
Fencer Vulns
high 7.5

CVE-2022-37603 json

loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable

published 2022-10-14 4 y ago modified 2026-06-17 4 mo ago also GHSA-3rfm-jhwj-7488 , EUVD-2022-7006

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.7%
EPSS 2.7% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.

Patch / fix

  • npm loader-utils 1.4.2, 2.0.4, 3.2.1
  • webpack.js loader-utils 1.4.2, 2.0.4, 3.2.1
  • node-loader-utils Debian 14, Debian 13, Debian 12 2.0.4-1

debian advisories DEBIAN-CVE-2022-37603

  • rh-sso7-keycloak red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el7sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el7sso
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el8sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el8sso
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el9sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.6-1.redhat_00001.1.el9sso

red hat advisories RHSA-2023:1043RHSA-2023:1044RHSA-2023:1045

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-37603 updated cvss 7.5

loader-utils: Regular expression denial of service

  • Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-ui-rhel8
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Developer Tools and Services odo Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Service Mesh 2.1 openshift-service-mesh/kiali-rhel8 Red Hat Ansible Automation Platform 2 aap-azure-ui
    affected: no fix available
  • Red Hat Decision Manager 7 loader-utils
    affected: no fix planned “Will not fix”
  • Red Hat Discovery 1 discovery-server-container
    affected: no fix available
  • Red Hat Enterprise Linux 6 firefox Red Hat Enterprise Linux 7 firefox
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 pcs, mozjs60, pcs-snmp, 389-ds-base, cockpit-389-ds, python3-lib389, +3 more Red Hat Enterprise Linux 9 gjs
    affected: no fix available “Fix deferred”
  • Red Hat Fuse 7 loader-utils Red Hat Integration Camel K 1 loader-utils
    affected: no fix planned “Will not fix”
show 17 more
  • Red Hat JBoss Enterprise Application Platform 6 loader-utils
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console Red Hat Openshift Data Foundation 4 odf4/odf-console-rhel9, odf4/odf-multicluster-console-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Dev Spaces devspaces/dashboard-rhel8, devspaces-theia-rhel8-container
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-query-rhel8, rhosdt/jaeger-all-in-one-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8
    affected: no fix available
  • Red Hat Process Automation 7 loader-utils Red Hat Quay 3 quay/quay-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-20
    fixed: vendor fix RHSA-2023:1047
  • Red Hat Migration Toolkit for Runtimes 1 on RHEL 8
    fixed: vendor fix RHSA-2023:0471
  • Red Hat MTA 6.0 for RHEL 8 mta/mta-ui-rhel8 6.0.1-10
    fixed: vendor fix RHSA-2023:0934
  • Red Hat Data Grid 8.4.1
    fixed: vendor fix RHSA-2023:0713
  • Red Hat Migration Toolkit 1.7 rhmtc/openshift-migration-ui-rhel8 v1.7.8-5
    fixed: vendor fix RHSA-2023:1428
  • Red Hat Single Sign-On 7
    fixed: vendor fix RHSA-2023:1049
  • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2023:1043
  • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2023:1044
  • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak 18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server 18.0.6-1.redhat_00001.1.el9sso
    fixed: vendor fix RHSA-2023:1045
  • Red Hat RHOL 5.5 for RHEL 8 openshift-logging/logging-view-plugin-rhel8 v5.5.5-2
    fixed: vendor fix RHSA-2022:8781
  • Red Hat MTA 6.0 for RHEL 8 mta/mta-hub-rhel8 6.0.1-8, mta/mta-pathfinder-rhel8 6.0.1-6, mta/mta-admin-addon-rhel8 6.0.1-8, mta/mta-windup-addon-rhel8 6.0.1-9 Red Hat OpenShift Service Mesh 2.0 servicemesh-grafana, servicemesh-prometheus, servicemesh-grafana-prometheus, openshift-service-mesh/kiali-rhel8 Red Hat OpenShift Service Mesh 2.1 servicemesh-grafana, servicemesh-prometheus Red Hat A-MQ Online loader-utils Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/grc-ui-rhel8, rhacm2/console-rhel8, rhacm2/search-ui-rhel8, rhacm2/application-ui-rhel8 Red Hat build of Apicurio Registry 2 loader-utils
    +3 more products
    Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, cockpit-podman, grafana-selinux, +9 more Red Hat Enterprise Linux 9 polkit, grafana, polkit-libs, grafana-selinux Red Hat Integration Service Registry loader-utils
    not affected: vulnerable code not present

7 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
17 mo ago

Exploit prediction

2.70% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L107 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm loader-utils
>=1.0.0, <1.4.2
>=2.0.0, <2.0.4
>=3.0.0, <3.2.1
1.4.2
2.0.4
3.2.1

Classification

Weakness
  • CWE-1333 Inefficient Regular Expression Complexity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.