Vulnerabilities > CVE-2019-20922 - Infinite Loop vulnerability in Handlebarsjs Handlebars

CVSS 7.8 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

COMPLETE

network

low complexity

handlebarsjs

CWE-835

NVD

Published: 2020-09-30

Updated: 2021-07-21

Summary

Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources.

Vulnerable Configurations

Part	Description	Count
Application	Handlebarsjs Handlebarsjs Handlebars 4.0.0 Handlebarsjs Handlebars 4.0.1 Handlebarsjs Handlebars 4.0.2 Handlebarsjs Handlebars 4.0.3 Handlebarsjs Handlebars 4.0.4 Handlebarsjs Handlebars 4.0.5 Handlebarsjs Handlebars 4.0.6 Handlebarsjs Handlebars 4.0.7 Handlebarsjs Handlebars 4.0.8 Handlebarsjs Handlebars 4.0.9 Handlebarsjs Handlebars 4.0.10 Handlebarsjs Handlebars 4.0.11 Handlebarsjs Handlebars 4.0.12 Handlebarsjs Handlebars 4.0.13 Handlebarsjs Handlebars 4.0.13-0 Handlebarsjs Handlebars 4.0.14 Handlebarsjs Handlebars 4.1.0 Handlebarsjs Handlebars 4.1.1 Handlebarsjs Handlebars 4.1.2 Handlebarsjs Handlebars 4.1.2-0 Handlebarsjs Handlebars 4.2.0 Handlebarsjs Handlebars 4.2.1 Handlebarsjs Handlebars 4.2.2 Handlebarsjs Handlebars 4.3.0 Handlebarsjs Handlebars 4.3.1 Handlebarsjs Handlebars 4.3.2 Handlebarsjs Handlebars 4.3.3 Handlebarsjs Handlebars 4.3.4 Handlebarsjs Handlebars 4.3.5 Handlebarsjs Handlebars 4.4.0 Handlebarsjs Handlebars 4.4.1 Handlebarsjs Handlebars 4.4.2 Handlebarsjs Handlebars 4.4.3 Handlebarsjs Handlebars 4.4.4	35

Common Weakness Enumeration (CWE)

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References