# CVE-2023-26117: Google AngularJS ReDoS in $resource service

Source: https://junglewise.ai/threats/cve-2023-26117-google-angularjs-redos-in-resource-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-03-30. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2023-26117 · Severity: low · CVSS 3.1 · Published 2023-03-30

AngularJS, a popular framework for building web applications, is vulnerable to a denial-of-service attack. By providing specially crafted, large inputs to the $resource service, an attacker can cause the application to consume excessive processing power. This can lead to the application becoming slow or completely unresponsive for legitimate users.

Technologies: [angular (npm)](https://junglewise.ai/threats/technologies/angular). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-26117 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-26117 being exploited in the wild.

**How severe is CVE-2023-26117?** Low severity, with a CVSS score of 3.1, published 30 March 2023.

**Which products and versions are affected?** angular (npm) SEMVER:introduced=0,last_affected=1.8.3.

**Is there a fix for CVE-2023-26117?** A patch was published on 2025-07-20: Debian LTS released a security update for angular.js. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-26117 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-26117?** Check whether you run angular (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

AngularJS versions 1.0.0 through 1.8.3 are vulnerable to Regular Expression Denial of Service (ReDoS) within the $resource service. The vulnerability is caused by an inefficient regular expression that is susceptible to catastrophic backtracking when processing specifically crafted, large input strings. An unauthenticated remote attacker can exploit this by sending malicious input to an application endpoint that utilizes the $resource service, leading to CPU exhaustion and a denial-of-service condition. The AngularJS project is archived and no longer receiving official updates, though some distributions like Debian and Fedora have provided backported fixes.

## Affected products

- Google angular from 1.0.0 up to and including 1.8.3

## Identifiers

- CVE-2023-26117
- GHSA-2qqx-w9hr-q5gx

## Timeline

- 2023-03-30: advisory: Initial publication of the GHSA advisory.
- 2024-04-12: other: AngularJS repository archived by owner.
- 2025-07-20: patched: Debian LTS released a security update for angular.js.

## References

- [https://github.com/angular/angular.js](https://github.com/angular/angular.js)
- [https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html](https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html)
- [https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQWJLE5WE33WNMA54XSJIDXBRK2KL3XJ](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQWJLE5WE33WNMA54XSJIDXBRK2KL3XJ)
- [https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UDKFLKJ6VZKL52AFVW2OVZRMJWHMW55K](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UDKFLKJ6VZKL52AFVW2OVZRMJWHMW55K)
- [https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-5406323](https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-5406323)
- [https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-5406325](https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-5406325)

## Related threats

- [Google AngularJS XSS bypass in Strict Contextual Escaping](https://junglewise.ai/threats/cve-2026-11998-google-angularjs-xss-bypass-in-strict-contextual-escaping)
- [AngularJS improper SVG element sanitization bypass](https://junglewise.ai/threats/cve-2025-0716-angularjs-improper-svg-element-sanitization-bypass)
- [AngularJS image srcset attribute bypass in Content Security Policy](https://junglewise.ai/threats/cve-2024-8372-angularjs-image-srcset-attribute-bypass-in-content-security-policy)
- [AngularJS srcset attribute sanitization bypass](https://junglewise.ai/threats/cve-2024-8373-angularjs-srcset-attribute-sanitization-bypass)
- [AngularJS regular expression denial of service in ng-srcset](https://junglewise.ai/threats/cve-2024-21490-angularjs-regular-expression-denial-of-service-in-ng-srcset)