-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe GitHub commit shows a critical modification to the 'domain_re' regex in URLValidator's host pattern matching. The vulnerability stems from the regex's structure allowing excessive backtracking (CWE-1333). The patch replaces the vulnerable pattern with one that uses negative lookaheads/lookbehinds ((?!-) and (?<!-)) to prevent backtracking attacks. The advisory explicitly states this was a security fix for URLValidator's regex inefficiency, and the CWE-1333 mapping confirms the regex complexity issue.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Django | pip | >= 1.8a1, < 1.8.3 | 1.8.3 |