4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-g75f-g53v-794x

GHSA-g75f-g53v-794x: Bleach linkify(parse_email=True) CPU exhaustion via unbounded email regex scanning

Summary

Bleach 6.3.0 exposes a documented email-linkification path through bleach.linkify(..., parse_email=True). The implementation scans attacker-controlled text with EMAIL_RE.finditer() over the full character token and has no length, timeout, or linear prefilter before applying the dot-atom email regex. A non-email payload around 30 KB causes multi-second CPU consumption per request/call, creating a direct availability risk for applications that enable email linkification on user-submitted text.

Affected Product

Package: bleach
Ecosystem: pip
Affected versions: verified in 6.3.0; exact first affected version not established
Patched versions: none known at finalization time
Tested version: 6.3.0
Audit commit/tag: v6.3.0 / 5546d5dbce60d08ccb99d981778d74044d646d4e
PyPI sdist SHA256: 6f3b91b1c0a02bb9a78b5a454c92506aa0fdf197e1d5e114d2e00c6f64306d22

Vulnerability Details

CWE: CWE-1333: Inefficient Regular Expression Complexity; related availability impact maps to CWE-400
Component: bleach/linkifier.py, build_email_re(), LinkifyFilter.handle_email_addresses()
Root cause: handle_email_addresses() calls self.email_re.finditer(text) on attacker-controlled text. EMAIL_RE includes a repeated dot-atom local-part pattern, so non-email strings such as repeated a. segments with no @ force repeated long failing scans.
Security boundary violated: user-submitted text processed by a documented safe linkification helper should not allow an attacker to impose superlinear CPU cost through non-email text.
Direct impact: per-request CPU exhaustion / denial-of-service risk in applications that enable parse_email=True on attacker-controlled text.

Miggo Vulnerability Database

→

GHSA-g75f-g53v-794x

GHSA-g75f-g53v-794x:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
bleach	pip	= 6.3.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the bleach library's email linkification feature. When bleach.linkify is called with parse_email=True, it uses a regular expression to find email addresses. This regex, built by build_email_re, is inefficient and can lead to catastrophic backtracking on certain input strings. The LinkifyFilter.handle_email_addresses function applies this regex to user-provided text. An attacker can craft a long string that doesn't contain an email address but causes the regex engine to consume excessive CPU, leading to a denial of service. The vulnerability exists in version 6.3.0 and there is no patch available at the time of the advisory.

Vulnerable functions

linkify

bleach/__init__.py

This is the main entry point for the vulnerable functionality. When called with `parse_email=True`, it triggers the inefficient regex matching.

LinkifyFilter.handle_email_addresses

bleach/linkifier.py

This function contains the call to `finditer` with the inefficient regex, which is the direct cause of the CPU exhaustion.

build_email_re

bleach/linkifier.py

This function constructs the inefficient regular expression that leads to the denial of service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.