CVE-2023-26118

mediumpriority · track · 22EPSS 0.017 · 77 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.70% (77th) EPSS

CVSS 5.3 · medium

Is it mine?

16 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> element due to the usage of an insecure regular expression in the input[url] functionality. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lprimary · NVD / NIST USexploitability 3.9 · impact 1.4

v3.15.3mediumAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · FSTEC (BDU) RU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:Psecondary · ENISA EU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · report@snyk.ioexploitability 3.9 · impact 1.4

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Lsecondary · OSV

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1333USprimaryCWE-1333USCWE-1333US

affected products (16)

Products and version ranges known to be affected.

Fedora Linuxall versionscert_bundDEcpe:/o:fedoraproject:fedora:-
HCL BigFixall versionscert_bundDEcpe:/a:hcltech:bigfix:-
IBM Business Automation Workflowall versionscert_bundDEcpe:/a:ibm:business_automation_workflow:-
IBM MQ 9.0all versionscert_bundDEcpe:/a:ibm:mq:9.0
IBM MQ 9.1all versionscert_bundDEcpe:/a:ibm:mq:9.1
IBM MQ 9.2all versionscert_bundDEcpe:/a:ibm:mq:9.2
IBM Tivoli Business Service Manager 6.2.0all versionscert_bundDEcpe:/a:ibm:tivoli_business_service_manager:6.2.0
n/a angular1.4.9 → *enisa_euvdEU
n/a org.webjars.bower:angular1.4.9 → *enisa_euvdEU
n/a org.webjars.bowergithub.angular:angular0 → *enisa_euvdEU
n/a org.webjars.npm:angular1.4.9 → *enisa_euvdEU
Google Inc Angular1.4.9 → 1.8.3fstec_bduRU
Wazuh, Inc Wazuh≤ 4.4.5fstec_bduRU
angularjs angularjs1.4.9 → 1.8.3nvdUScpe:2.3:a:angularjs:angularjs:*:*:*:*:*:*:*:*
fedoraproject fedora= 38nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
npm angular≤ 1.8.3osvUSpkg:npm/angular

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-1208HCL BigFix: Mehrere SchwachstellenDeutsch2023-05-14csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in HCL BigFix ausnutzen, um einen Denial of Service Zustand herbeizuführen oder Sicherheitsvorkehrungen zu umgehen.
WID-SEC-W-2024-0967IBM MQ: Mehrere SchwachstellenDeutsch2024-04-24csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM MQ ausnutzen, um einen Denial of Service Angriff durchzuführen oder Cross-Site Scripting (XSS)-Angriffe durchzuführen.
GHSA-qwqh-hm9m-p5hrangular vulnerable to regular expression denial of service via the <input type="url"> element2023-03-30ghsa · osvUS
All versions of the package angular are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> element due to the usage of an insecure regular expression in the input[url] functionality. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund nvd osv NVD CVE.org MITRE

published 2023-03-30modified 2026-06-17

related (603)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2023-3364US	high7.5	44.5% (99th)	—	2023-08-02
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2…
CVE-2022-24713US	high7.5	14.5% (97th)	Exploit	2022-03-08
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted rege…
CVE-2024-8124US	high7.5	40.2% (99th)	—	2024-09-12
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.1.7, starting from 17.2 prior to 17.2.5, starting from 17.3 prior to 17.3.2 which cou…
CVE-2021-3749US	high7.5	8.52% (95th)	Exploit	2021-08-31
axios is vulnerable to Inefficient Regular Expression Complexity
CVE-2024-25126US	high7.5	35.4% (98th)	—	2024-02-29
Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible deni…

+598 more

references (27)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan