CVE-2023-26118 — Regex Denial of Service in Angular

CWE-1333 — Regex Denial of Service9 documents7 sources
Severity
5.3MEDIUMNVD
OSV6.1
EPSS
0.5%
top 32.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
AngularAngularjsFedoraproject Fedora
Timeline
PublishedMar 30
Latest updateJan 14

Description

Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the element due to the usage of an insecure regular expression in the input[url] functionality. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5angular/angular1.4.9 — *
▶npmangular/angular1.8.3
▶NVDangularjs/angularjs1.4.9 — 1.8.3

Also affects: Fedora 38

🔴Vulnerability Details

5
OSV
angular.js vulnerabilities↗2026-01-14
▶
OSV
CVE-2023-26118: Versions of the package angular from 1↗2023-03-30
▶
CVEList
CVE-2023-26118: Versions of the package angular from 1↗2023-03-30
▶
OSV
angular vulnerable to regular expression denial of service via the <input type="url"> element↗2023-03-30
▶
GHSA
angular vulnerable to regular expression denial of service via the <input type="url"> element↗2023-03-30
▶

📋Vendor Advisories

3
Ubuntu
AngularJS vulnerabilities↗2026-01-14
▶
Red Hat
angularjs: Regular Expression Denial of Service via the <input type="url"> element↗2023-03-30
▶
Debian
CVE-2023-26118: angular.js - Versions of the package angular from 1.4.9 are vulnerable to Regular Expression ...↗2023
▶