{
"id": "GHSA-9pq7-rcxv-47vq",
"aliases": [
"CVE-2021-27293"
],
"details": "RestSharp < 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTimes. If a server responds with a malicious string, the client using RestSharp will be stuck processing it for an exceedingly long time. Thus the remote server can trigger Denial of Service.",
"summary": "Incorrect Regular Expression in RestSharp",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "106.11.8-alpha.0.13"
}
]
}
],
"package": {
"name": "RestSharp",
"ecosystem": "NuGet"
},
"database_specific": {
"last_known_affected_version_range": "<= 106.11.7"
}
}
],
"modified": "2021-07-15T20:24:43Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"published": "2021-07-14T19:10:01Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27293",
"type": "ADVISORY"
},
{
"url": "https://github.com/restsharp/RestSharp/issues/1556",
"type": "WEB"
},
{
"url": "https://github.com/restsharp/RestSharp/commit/be39346784b68048b230790d15333574341143bc",
"type": "WEB"
},
{
"url": "https://restsharp.dev",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-185",
"CWE-697"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": "2021-07-12T11:15:00Z",
"github_reviewed_at": "2021-07-13T21:24:43Z"
}
}