CVE-2026-111714
LOW
2,3
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
LOW
3,1
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: low
Description
AI Translation Available
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0022
Percentile
0,1th
Updated
EPSS Score Trend (Last 3 Days)
1333
Inefficient Regular Expression Complexity
DraftCommon Consequences
Security Scopes Affected:
Availability
Potential Impacts:
Dos: Resource Consumption (Cpu)
Applicable Platforms
All platforms may be affected
https://github.com/AmauriC/tarteaucitron.js/blob/v1.36.0/tarteaucitron.js#L2169…
https://github.com/AmauriC/tarteaucitron.js/commit/60faaba5fd541cad770549d422fc…
https://github.com/AmauriC/tarteaucitron.js/releases/tag/v1.37.0
https://www.vulncheck.com/advisories/tarteaucitron-js-before-1.37.0-redos-via-u…