Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-6817

bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).

Published

2023-02-16T22:15:10.650

Last Modified

2025-03-19T16:15:14.917

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

Weaknesses
  • Type: Primary
    CWE-1333
  • Type: Secondary
    CWE-1333
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application mozilla bleach < 3.1.4 Yes
References