RestSharp < 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTimes. If a server responds with a malicious string, the client using RestSharp will be stuck processing it for an exceedingly long time. Thus the remote server can trigger Denial of Service.
CVE-2021-27293 - High Severity Vulnerability
Simple REST and HTTP API Client
Library home page: https://api.nuget.org/packages/restsharp.105.1.0.nupkg
Dependency Hierarchy: - :x: **restsharp.105.1.0.nupkg** (Vulnerable Library)
Found in HEAD commit: e7f778824724811f04d4330e6762202605f74556
Found in base branch: master
RestSharp < 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTimes. If a server responds with a malicious string, the client using RestSharp will be stuck processing it for an exceedingly long time. Thus the remote server can trigger Denial of Service.
Publish Date: 2021-07-12
URL: CVE-2021-27293
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/advisories/GHSA-9pq7-rcxv-47vq
Release Date: 2021-07-12
Fix Resolution: RestSharp - 106.11.8-alpha.0.13