CVE-2018-19826 — Infinite Loop in Libsass

CWE-835 — Infinite Loop6 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.4%
top 37.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Sass-lang Libsass
Timeline
PublishedDec 3
Latest updateMay 13

Description

In inspect.cpp in LibSass 3.5.5, a high memory footprint caused by an endless loop (containing a Sass::Inspect::operator()(Sass::String_Quoted*) stack frame) may cause a Denial of Service via crafted sass input files with stray '&' or '/' characters. NOTE: Upstream comments indicate this issue is closed as "won't fix" and "works as intended" by design

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages1 packages

🔴Vulnerability Details

1
GHSA
GHSA-vj6g-6xq4-cmrw: ** DISPUTED ** In inspect↗2022-05-13
▶

📋Vendor Advisories

1
Red Hat
libsass: Infinite loop in Sass::Inspect::operator() function resulting in a denial of service↗2018-12-03
▶

💬Community

3
Bugzilla
CVE-2018-19797 CVE-2018-19826 CVE-2018-19827 CVE-2018-19837 CVE-2018-19838 CVE-2018-19839 CVE-2018-20190 libsass: various flaws [epel-7]↗2019-01-31
▶
Bugzilla
CVE-2018-19797 CVE-2018-19826 CVE-2018-19827 CVE-2018-19837 CVE-2018-19838 CVE-2018-19839 CVE-2018-20190 libsass: various flaws [fedora-all]↗2019-01-31
▶
Bugzilla
CVE-2018-19826 libsass: Infinite loop in Sass::Inspect::operator() function resulting in a denial of service↗2019-01-31
▶