Executive brief
SunbirdEd-portal is the web interface for the Sunbird e-learning platform. A vulnerability in how the portal processes text patterns could allow an attacker to crash the service or make it unresponsive by sending specially crafted input. This could lead to a denial of service, preventing students and educators from accessing learning materials and online functionality.
Technical details
An Inefficient Regular Expression Complexity (CWE-1333) vulnerability exists in Sunbird-Ed SunbirdEd-portal version 1.13.4. The flaw is rooted in the application's use of a regular expression with high computational complexity when processing user-supplied input. A remote, unauthenticated attacker can exploit this by submitting a maliciously crafted string that triggers catastrophic backtracking, leading to excessive CPU consumption and a Denial of Service (DoS) condition. The vulnerability was disclosed via a third-party advisory on GitHub Gist.
Affected products
- Sunbird-Ed SunbirdEd-portal 1.13.4
Timeline
- 2025-03-09: disclosed: Vulnerability details shared via GitHub Gist and MITRE.
- 2026-03-09: advisory: NVD published the CVE record.