Executive brief
Bleach is a Python library used to clean and sanitize untrusted HTML text, often used in web applications to process user comments or profiles. A flaw in its optional email-linking feature allows an attacker to submit specially crafted text that causes the server to consume excessive CPU resources. This can lead to a denial-of-service condition where the application becomes slow or unresponsive to other users.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) (CWE-1333) located in 'bleach/linkifier.py'. When 'parse_email=True' is passed to 'bleach.linkify()', the 'EMAIL_RE' regular expression is applied to user-controlled text via 'finditer()'. The regex contains a repeated dot-atom pattern that exhibits superlinear complexity when processing long strings of repeated segments (e.g., 'a.a.a...') that do not contain an '@' symbol. An attacker can exploit this by submitting a payload of approximately 30 KB, causing multi-second CPU hangs per request. No patch was available at the time of the advisory.
Affected products
- Mozilla bleach 6.3.0
Timeline
- 2026-06-05: disclosed
- 2026-06-16: advisory