CVE-2020-6817

highpriority · track · 30EPSS 0.007 · 54 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.72% (54th) EPSS

CVSS 7.5 · high

Is it mine?

3 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · osv · nvd

EPSS · scored 2026-10-27

bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondaryexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1333USprimaryCWE-1333USCWE-400US

affected products (3)

Products and version ranges known to be affected.

Mozilla Mozilla Bleachunspecified → 3.1.4enisa_euvdEU
mozilla bleach< 3.1.4nvdUScpe:2.3:a:mozilla:bleach:*:*:*:*:*:*:*:*
PyPI bleach< 3.1.4osvUSpkg:pypi/bleach

advisories (2)

Vendor and ecosystem advisories describing this.

GHSA-vqhp-cxgc-6wmmregular expression denial-of-service (ReDoS) in Bleach2020-03-30ghsa · osvUS
### Impact `bleach.clean` behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to ``bleach.clean`` with an allowed tag with an allowed ``style`` attribute are vulnerable to ReDoS. For example, ``bleach.clean(..., attributes={'a': ['style']})``. ### Patches 3.1.4 ### Workarounds * do not whitelist the style attribute in `bleach.clean` calls * limit input string length ### References * https://bugzilla.mozilla.org/show_bug.cgi?id=1623633 * https://www.regular-expressions.info/redos.html * https://blog.r2c.dev/posts/finding-python-redos-bugs-at-scale-using-dlint-and-r2c/ * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6817 ### Credits * Reported by schwag09 of r2c ### For more information If you have any questions or comments about this advisory: * Open an issue at https://github.com/mozilla/bleach/issues * Email us at security@mozilla.org
PYSEC-2020-3402020-03-30vendor · osvUS
In Mozilla Bleach before 3.1.4, `bleach.clean` behavior parsing style attributes could result in a regular expression denial of service (ReDoS).

also known as (7)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv nvd NVD CVE.org MITRE

published 2023-02-16modified 2026-06-17

related (604)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2023-3364US	high7.5	44.5% (99th)	—	2023-08-02
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2…
CVE-2022-24713US	high7.5	14.5% (97th)	Exploit	2022-03-08
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted rege…
CVE-2024-8124US	high7.5	40.2% (99th)	—	2024-09-12
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.1.7, starting from 17.2 prior to 17.2.5, starting from 17.3 prior to 17.3.2 which cou…
CVE-2021-3749US	high7.5	8.52% (95th)	Exploit	2021-08-31
axios is vulnerable to Inefficient Regular Expression Complexity
CVE-2024-25126US	high7.5	35.4% (98th)	—	2024-02-29
Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible deni…

+599 more

references (10)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan