Regular Expression Denial of Service in flask-restx

ÉLEVÉE 7.5CVE-2021-32838 · GHSA-3q6g-vf58-7m4g · PYSEC-2021-325 · Published 20/09/2021 · updated 17/06/2026

En bref

CVE-2021-32838 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant flask-restx, flask-restx (flask-restx project).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.9%, plus élevée que 79.4% des vulnérabilités.
Correctif : mettre à jour vers 0.5.1 ou plus récent.

Package	Affected versions	Patched versions
flask-restx PyPI	`< 0.5.1`	`0.5.1`
flask-restx flask-restx_project	`< 0.5.1`	`0.5.1`

Description

Flask RESTX contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in email_regex.

NVD description

Flask-RESTX (pypi package flask-restx) is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS (Regular Expression Denial of Service) in email_regex. This is fixed in version 0.5.1.

References

python-restx/flask-restx security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-32838 · ADVISORY
python-restx/flask-restx · WEB
python-restx/flask-restx commit bab31e0 · WEB
GitHub Advisory GHSA-3q6g-vf58-7m4g · ADVISORY
pypa/advisory-database · WEB
python-restx/flask-restx · PACKAGE
python-restx/flask-restx · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/5UCTFVDU3677B5OBGK4EF5NMUPJLL6SQ · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/QUD6SWZLX52AAZUHDETJ2CDMQGEPGFL3

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free