Skip to content

Commit ba90671

Browse files
authored
Update README.md
1 parent 95cec2d commit ba90671

File tree

1 file changed

+3
-1
lines changed

1 file changed

+3
-1
lines changed

README.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@
44

55
Find regexes which are vulnerable to Regular Expression Denial of Service (ReDoS).
66

7+
**More info on [the Doyensec blog](https://blog.doyensec.com/2021/03/11/regexploit.html)**
8+
79
Many default regular expression parsers have unbounded worst-case complexity. Regex matching may be quick when presented with a matching input string. However, certain non-matching input strings can make the regular expression matcher go into crazy backtracking loops and take ages to process. This can cause denial of service, as the CPU will be stuck trying to match the regex.
810

911
This tool is designed to:
@@ -159,7 +161,7 @@ regexploit-csharp something.cs
159161
* [CVE-2021-27293: RestSharp](https://github.com/restsharp/RestSharp/issues/1556) (JSON deserialisation in a .NET C# package)
160162
* [bpo-38804: cpython's http.cookiejar](https://github.com/python/cpython/pull/17157) (Set-Cookie header parsing)
161163
* [SimpleCrawler (archived)](https://doyensec.com/resources/Doyensec_Advisory_simplecrawler_redos.pdf) (HTML parsing)
162-
* CVE-2021-28092: to be released
164+
* [CVE-2021-28092: is-svg](https://github.com/sindresorhus/is-svg/commit/01f8a087fab8a69c3ac9085fbb16035907ab6a5b) (SVG parsing)
163165
* Plus unpublished bugs in a handful of pypi, npm, ruby and nuget packages
164166

165167
## Credits

0 commit comments

Comments
 (0)