Executive brief
jquery-validation is a popular JavaScript library used to validate HTML forms on websites. A regular expression denial of service (ReDoS) vulnerability in the library's URL validation method can cause the application to hang or become unresponsive when processing specially crafted input, potentially disrupting user access to web applications that rely on this validation.
Technical details
This is an exponential ReDoS (Regular Expression Denial of Service) vulnerability affecting the url2 validation method in jquery-validation. An attacker who can supply arbitrary input to this method can craft a malicious string that causes the regular expression to perform excessive backtracking, consuming CPU resources and causing the application to hang. This is an incomplete fix for a previous vulnerability (CVE-2021-43306). The vulnerability requires network access and no authentication; the attack vector is supplying malicious input through a web form. Patch version 1.19.5 addresses this issue.
Affected products
- jquery-validation jquery-validation before 1.19.5
Timeline
- 2022-07-05: disclosed: GHSA-ffmh-x56j-9rc3 published
- 2022-07-14: other: CVE-2022-31147 published on NVD
- 2022-07-05: patched: Version 1.19.5 released with fix