CVE-2023-26117 — Regex Denial of Service in Angular

CWE-1333 — Regex Denial of Service10 documents8 sources
Severity
5.3MEDIUMNVD
OSV6.1
EPSS
0.3%
top 45.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
AngularAngularjsFedoraproject Fedora
Timeline
PublishedMar 30
Latest updateJan 14

Description

Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5angular/angular1.0.0 — *
▶npmangular/angular1.8.3
▶NVDangularjs/angularjs1.0.0 — 1.8.3

Also affects: Fedora 38

🔴Vulnerability Details

5
OSV
angular.js vulnerabilities↗2026-01-14
▶
GHSA
angular vulnerable to regular expression denial of service via the $resource service↗2023-03-30
▶
OSV
angular vulnerable to regular expression denial of service via the $resource service↗2023-03-30
▶
OSV
CVE-2023-26117: Versions of the package angular from 1↗2023-03-30
▶
CVEList
CVE-2023-26117: Versions of the package angular from 1↗2023-03-30
▶

📋Vendor Advisories

4
Ubuntu
AngularJS vulnerabilities↗2026-01-14
▶
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: General (Apache ActiveMQ) — CVE-2021-26117↗2023-07-15
▶
Red Hat
angularjs: Regular expression denial of service via the $resource service↗2023-03-30
▶
Debian
CVE-2023-26117: angular.js - Versions of the package angular from 1.0.0 are vulnerable to Regular Expression ...↗2023
▶