Regular Expression Denial of Service Vulnerability in Bleach by Mozilla

CVE-2020-6817

Summary

A vulnerability in the Bleach library could allow attackers to exploit the parsing behavior of style attributes, potentially leading to a regular expression denial of service. When the bleach.clean function is utilized with specific allowed tags and style attributes, it may trigger unbounded backtracking in the regex, resulting in significant performance degradation or application crashes. This vulnerability poses a risk in scenarios where untrusted input can be processed by the bleach.clean method with specified attributes.

References