CVE-2021-32723: Regular Expression Denial of Service (ReDoS) in Prism
Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fixed in Prism v1.24. As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text. Other languages are not affected and can be used to highlight untrusted text.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-32723?
CVE-2021-32723 is a vulnerability in Prism, a syntax highlighting library, where some languages before version 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS).
How does CVE-2021-32723 affect Prism?
CVE-2021-32723 affects Prism by allowing an attacker to craft a string that will cause a very long time to highlight when untrusted (user-given) text is used for highlighting.
What is the severity of CVE-2021-32723?
The severity of CVE-2021-32723 is high with a CVSS score of 6.5.
Which versions of Prism are affected by CVE-2021-32723?
Versions of Prism before 1.24.0 are affected by CVE-2021-32723.
How can I fix the CVE-2021-32723 vulnerability in Prism?
To fix the CVE-2021-32723 vulnerability in Prism, update to version 1.24.0 or newer.