CVE-2019-1010266: Medium severity lodash vulnerability
A vulnerability was found in lodash prior to 4.7.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression.
Reference: https://github.com/lodash/lodash/issues/3359 https://snyk.io/vuln/SNYK-JS-LODASH-73639
Other sources
lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-1010266?
CVE-2019-1010266 is a vulnerability in Lodash that can be exploited by a local attacker to cause a denial of service.
How does CVE-2019-1010266 work?
CVE-2019-1010266 is caused by uncontrolled resource consumption in the Date handler of Lodash, which allows an attacker to crash the application by sending an overly long string.
What is the severity of CVE-2019-1010266?
CVE-2019-1010266 has a severity rating of medium (4) due to the potential denial of service impact.
Which software is affected by CVE-2019-1010266?
Lodash version 4.7.11 is affected by CVE-2019-1010266. IBM Security Verify Governance versions up to and including 10.0 are also affected.
How can I fix CVE-2019-1010266?
To fix CVE-2019-1010266, update Lodash to version 4.7.11 or higher. For IBM Security Verify Governance, update to a version higher than 10.0.