Skip to content
Fencer Vulns
medium 5.3

CVE-2023-48631 json

Denial of Service of regular expression in package @adobe/css-tools

published 2023-11-30 2 y ago modified 2026-06-17 4 mo ago also GHSA-prr3-c3m5-p7q2 , EUVD-2023-3011

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits
0
none known

Summary

@adobe/css-tools versions 4.3.1 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS.

Patch / fix

  • npm @adobe/css-tools 4.3.2
  • adobe css-tools 4.3.2

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-48631 updated cvss 7.5

css-tools: regular expression denial of service (ReDoS) when parsing CSS

  • Red Hat Migration Toolkit for Applications 6 mta/mta-ui-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-console-plugin-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8 Red Hat Ansible Automation Platform 2 aap-cloud-ui-container
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/nmstate-console-plugin-rhel9 Red Hat OpenShift Data Science (RHODS) rhods/odh-dashboard-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift distributed tracing 3 rhosdt/jaeger-agent-rhel8
    affected: workaround, no fix available
  • Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Migration Toolkit for Runtimes 1 on RHEL 8 mtr/mtr-rhel8-operator 1.2-15, mtr/mtr-operator-bundle 1.2-23, mtr/mtr-web-container-rhel8 1.2-16, mtr/mtr-web-executor-container-rhel8 1.2-14
    fixed: vendor fix RHSA-2024:3919
  • Red Hat MTA 6.2 for RHEL 8 mta/mta-windup-addon-rhel9 6.2.3-2
    fixed: vendor fix RHSA-2024:3989
  • Red Hat MTA 7.0 for RHEL 9 mta/mta-ui-rhel9 7.0.3-13, mta/mta-cli-rhel9 7.0.3-16
    fixed: vendor fix RHSA-2024:3316
show 3 more
  • Red Hat RHDH 1.1 for RHEL 9 rhdh/rhdh-hub-rhel9 1.1-97
    fixed: vendor fix RHEA-2024:1366
  • Red Hat RHODF 4.15 for RHEL 9 odf4/odf-console-rhel9 v4.15.0-57
    fixed: vendor fix RHSA-2024:1383
  • Red Hat Cryostat 2 css-tools Red Hat MTA 6.2 for RHEL 8 mta/mta-ui-rhel9 6.2.3-2, mta/mta-hub-rhel9 6.2.3-1, mta/mta-rhel8-operator 6.2.3-1, mta/mta-operator-bundle 6.2.3-4, mta/mta-pathfinder-rhel9 6.2.3-1 Red Hat MTA 7.0 for RHEL 8 mta/mta-rhel8-operator 7.0.3-7 Red Hat MTA 7.0 for RHEL 9 mta/mta-hub-rhel9 7.0.3-10, mta/mta-operator-bundle 7.0.3-25, mta/mta-windup-shim-rhel9 7.0.3-12, mta/mta-analyzer-lsp-rhel9 7.0.3-13, mta/mta-analyzer-addon-rhel9 7.0.3-13 Red Hat Build of Keycloak css-tools Red Hat build of OptaPlanner 8 css-tools
    +4 more products
    Red Hat Data Grid 8 css-tools Red Hat JBoss Enterprise Application Platform 8 css-tools Red Hat RHDH 1.1 for RHEL 9 rhdh/rhdh-rhel9-operator 1.1-85, rhdh/rhdh-operator-bundle 1.1-118 Red Hat RHODF 4.15 for RHEL 9 odf4/cephcsi-rhel9 v4.15.0-37, odf4/odf-cli-rhel9 v4.15.0-22, odf4/mcg-core-rhel9 v4.15.0-68, odf4/mcg-rhel9-operator v4.15.0-39, odf4/ocs-rhel9-operator v4.15.0-79, odf4/odf-rhel9-operator v4.15.0-19, +19 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.11% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 5.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
npm @adobe/css-tools
<4.3.2
4.3.2

Affected products

  • Adobe Not a product

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-1333 Inefficient Regular Expression Complexity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.