CVE-2024-21503

State: Published
Severity: 5.3 Medium
Published: Mar 19, 2024
Updated: Aug 1, 2024
Reserved: Dec 22, 2023

Description

Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P	snyk

Weaknesses

CWE-1333 Regular Expression Denial of Service (ReDoS)
CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Affected Products

Product	Versions
blackn/a	before 24.3.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.