PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›CVE-2018-1107

CVE-2018-1107

nodejs-is-my-json-valid: ReDoS when validating JSON fields with email format

Loading…

Severity

Moderate

Red Hat Product Security

5.3

CVSS 3.0

Review impact separately from score.

Published · February 16, 2018

Updated · June 28, 2026

Description

It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated.

Statement

In Red Hat Quay the is-my-json-valid library is included as a build time dependency of protractor. It's only used at build time, not at runtime reducing the impact to low.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 5.3
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-400 · Uncontrolled Resource Consumption