Regular Expression Denial of Service in flask-restx

HOCH 7.5CVE-2021-32838 · GHSA-3q6g-vf58-7m4g · PYSEC-2021-325 · Published 20/09/2021 · updated 17/06/2026

Kurz gesagt

CVE-2021-32838 ist eine Schwachstelle (HOCH (CVSS 7.5)) in flask-restx, flask-restx (flask-restx project).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.9%, höher als bei 79.4% aller Schwachstellen.
Abhilfe: auf 0.5.1 oder neuer aktualisieren.

Package	Affected versions	Patched versions
flask-restx PyPI	`< 0.5.1`	`0.5.1`
flask-restx flask-restx_project	`< 0.5.1`	`0.5.1`

Description

Flask RESTX contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in email_regex.

NVD description

Flask-RESTX (pypi package flask-restx) is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS (Regular Expression Denial of Service) in email_regex. This is fixed in version 0.5.1.

References

python-restx/flask-restx security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-32838 · ADVISORY
python-restx/flask-restx · WEB
python-restx/flask-restx commit bab31e0 · WEB
GitHub Advisory GHSA-3q6g-vf58-7m4g · ADVISORY
pypa/advisory-database · WEB
python-restx/flask-restx · PACKAGE
python-restx/flask-restx · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/5UCTFVDU3677B5OBGK4EF5NMUPJLL6SQ · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/QUD6SWZLX52AAZUHDETJ2CDMQGEPGFL3

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free