CVE-2020-6817
published 2023-02-16CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with…
PriorityP433high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.72%
49.7th percentile
bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-bleach | < python-bleach 3.1.4-1 (bookworm) | python-bleach 3.1.4-1 (bookworm) |
| mozilla | bleach | < 3.1.4 | 3.1.4 |
| mozilla | bleach | >= 0 < 3.1.4 | 3.1.4 |
| mozilla | mozilla_bleach | >= unspecified < 3.1.4 | 3.1.4 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ghsa7.5HIGH
osv9.8CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python-bleach vulnerabilities
osv·2026-03-05·CVSS 9.8
CVE-2018-7753 [CRITICAL] python-bleach vulnerabilities
python-bleach vulnerabilities
It was discovered that Bleach did not properly sanitize URI attributes
containing character entities. An attacker could possibly use this issue
to construct a URI with a disallowed scheme that would bypass
sanitization, leading to cross-site scripting. This issue only affected
Ubuntu 18.04 LTS. (CVE-2018-7753)
Yaniv Nizry discovered that Bleach was vulnerable to a mutation
cross-site scripting issue when sanitizing HTML with the noscript tag
and a raw tag in the allowed tags list. An attacker could possibly
use this issue to inject malicious content, leading to cross-site
scripting. This issue only affected Ubuntu 18.04 LTS. (CVE-2020-6802)
Yaniv Nizry discovered that Bleach was vulnerable to a mutation
cross-site scripting issue when sanitizing HTML with R
OSV
CVE-2020-6817: bleach
osv·2023-02-16·CVSS 7.5
CVE-2020-6817 [HIGH] CVE-2020-6817: bleach
bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
OSV
regular expression denial-of-service (ReDoS) in Bleach
osv·2020-03-30·CVSS 7.5
CVE-2020-6817 [HIGH] regular expression denial-of-service (ReDoS) in Bleach
regular expression denial-of-service (ReDoS) in Bleach
### Impact
`bleach.clean` behavior parsing style attributes could result in a regular expression denial of service (ReDoS).
Calls to ``bleach.clean`` with an allowed tag with an allowed ``style`` attribute are vulnerable to ReDoS. For example, ``bleach.clean(..., attributes={'a': ['style']})``.
### Patches
3.1.4
### Workarounds
* do not whitelist the style attribute in `bleach.clean` calls
* limit input string length
### References
* https://bugzilla.mozilla.org/show_bug.cgi?id=1623633
* https://www.regular-expressions.info/redos.html
* https://blog.r2c.dev/posts/finding-python-redos-bugs-at-scale-using-dlint-and-r2c/
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6817
### Credits
* Reported by schwag09 of r2c
#
OSV
CVE-2020-6817: In Mozilla Bleach before 3
osv·2020-03-30
CVE-2020-6817 CVE-2020-6817: In Mozilla Bleach before 3
In Mozilla Bleach before 3.1.4, `bleach.clean` behavior parsing style attributes could result in a regular expression denial of service (ReDoS).
GHSA
regular expression denial-of-service (ReDoS) in Bleach
ghsa·2020-03-30·CVSS 7.5
CVE-2020-6817 [HIGH] CWE-1333 regular expression denial-of-service (ReDoS) in Bleach
regular expression denial-of-service (ReDoS) in Bleach
### Impact
`bleach.clean` behavior parsing style attributes could result in a regular expression denial of service (ReDoS).
Calls to ``bleach.clean`` with an allowed tag with an allowed ``style`` attribute are vulnerable to ReDoS. For example, ``bleach.clean(..., attributes={'a': ['style']})``.
### Patches
3.1.4
### Workarounds
* do not whitelist the style attribute in `bleach.clean` calls
* limit input string length
### References
* https://bugzilla.mozilla.org/show_bug.cgi?id=1623633
* https://www.regular-expressions.info/redos.html
* https://blog.r2c.dev/posts/finding-python-redos-bugs-at-scale-using-dlint-and-r2c/
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6817
### Credits
* Reported by schwag09 of r2c
#
Ubuntu
Bleach vulnerabilities
vendor_ubuntu·2026-03-05·CVSS 9.8
CVE-2018-7753 [CRITICAL] Bleach vulnerabilities
Title: Bleach vulnerabilities
Summary: Several security issues were fixed in Bleach.
It was discovered that Bleach did not properly sanitize URI attributes
containing character entities. An attacker could possibly use this issue
to construct a URI with a disallowed scheme that would bypass
sanitization, leading to cross-site scripting. This issue only affected
Ubuntu 18.04 LTS. (CVE-2018-7753)
Yaniv Nizry discovered that Bleach was vulnerable to a mutation
cross-site scripting issue when sanitizing HTML with the noscript tag
and a raw tag in the allowed tags list. An attacker could possibly
use this issue to inject malicious content, leading to cross-site
scripting. This issue only affected Ubuntu 18.04 LTS. (CVE-2020-6802)
Yaniv Nizry discovered that Bleach was vulnerable to a mutatio
Debian
CVE-2020-6817: python-bleach - bleach.clean behavior parsing style attributes could result in a regular express...
vendor_debian·2020·CVSS 7.5
CVE-2020-6817 [HIGH] CVE-2020-6817: python-bleach - bleach.clean behavior parsing style attributes could result in a regular express...
bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
Scope: local
bookworm: resolved (fixed in 3.1.4-1)
bullseye: resolved (fixed in 3.1.4-1)
forky: resolved (fixed in 3.1.4-1)
sid: resolved (fixed in 3.1.4-1)
trixie: resolved (fixed in 3.1.4-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-6817 python-bleach: behavior parsing style attributes could result in a regular expression denial of service (ReDoS) [epel-all]
bugzilla·2020-04-03·CVSS 7.5
CVE-2020-6817 [HIGH] CVE-2020-6817 python-bleach: behavior parsing style attributes could result in a regular expression denial of service (ReDoS) [epel-all]
CVE-2020-6817 python-bleach: behavior parsing style attributes could result in a regular expression denial of service (ReDoS) [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit messa
Bugzilla
CVE-2020-6817 python-bleach: behavior parsing style attributes could result in a regular expression denial of service (ReDoS)
bugzilla·2020-04-03·CVSS 7.5
CVE-2020-6817 [HIGH] CVE-2020-6817 python-bleach: behavior parsing style attributes could result in a regular expression denial of service (ReDoS)
CVE-2020-6817 python-bleach: behavior parsing style attributes could result in a regular expression denial of service (ReDoS)
Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
Discussion:
Upstream Reference:
https://github.com/mozilla/bleach/security/advisories/GHSA-vqhp-cxgc-6wmm
---
Created python-bleach tracking bugs for this issue:
Affects: epel-all [bug 1820624]
Affects: fedora-all [bug 1820625]
---
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.
Bugzilla
CVE-2020-6817 python-bleach: behavior parsing style attributes could result in a regular expression denial of service (ReDoS) [fedora-all]
bugzilla·2020-04-03·CVSS 7.5
CVE-2020-6817 [HIGH] CVE-2020-6817 python-bleach: behavior parsing style attributes could result in a regular expression denial of service (ReDoS) [fedora-all]
CVE-2020-6817 python-bleach: behavior parsing style attributes could result in a regular expression denial of service (ReDoS) [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit m
Bugzilla
Regular expression denial-of-service in mozilla/bleach BleachSanitizerFilter.sanitize_css gauntlet regular expression
bugzilla·2020-03-19
[MEDIUM] Regular expression denial-of-service in mozilla/bleach BleachSanitizerFilter.sanitize_css gauntlet regular expression
Regular expression denial-of-service in mozilla/bleach BleachSanitizerFilter.sanitize_css gauntlet regular expression
Hi there,
I believe I've found a DoS bug in the [mozilla/bleach](https://github.com/mozilla/bleach) library. The bug itself is in the `BleachSanitizerFilter.sanitize_css` function. The vulnerability can be exploited with the following code:
```python
In [1]: import bleach
In [2]: bleach.__version__
Out[2]: '3.1.3'
In [3]: payload = "'" + '"a"' * 64 + '^' + "'"
In [4]: bleach.clean('', attributes={'a': ['style']})
...Spins...
```
The bug itself is a [ReDoS bug](https://www.regular-expressions.info/redos.html). It occurs due to the `gauntlet` regular expression:
```python
gauntlet = re.compile(
r"""^([-/:,#%.'"\s!\w]|\w-\w|'[\s\w]+'\s*|"[\s\w]+"|\([\d,%\.\s]+\))*$""",
fl
2023-02-16
Published