python · bleachHeads-up
bleach 6.3.0: ReDoS via email linkification in EMAIL_RE
Bleach 6.3.0 exposes a documented email-linkification path that can cause multi-second CPU consumption per request when processing attacker-controlled non-email
What changed
Bleach 6.3.0 exposes a documented email-linkification path that can cause multi-second CPU consumption per request when processing attacker-controlled non-email text of around 30 KB, due to inefficient regular expression complexity in EMAIL_RE.
Who it affects
Applications using bleach.linkify with parse_email=True on user-submitted text, especially those without input length limits or request timeouts.
What to do today
Disable parse_email=True or apply input length limits and request timeouts until a patch is available.
The trail
Collected→
Audited→
Written→
Published
Source
GitHub Advisory · bleach