Regular Expression Denial of Service in flask-restx

높음 7.5CVE-2021-32838 · GHSA-3q6g-vf58-7m4g · PYSEC-2021-325 · Published 20/09/2021 · updated 17/06/2026

요약

CVE-2021-32838은(는) flask-restx, flask-restx (flask-restx project)에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.9%, 전체 취약점의 79.4%보다 높음.
조치: 0.5.1 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
flask-restx PyPI	`< 0.5.1`	`0.5.1`
flask-restx flask-restx_project	`< 0.5.1`	`0.5.1`

Description

Flask RESTX contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in email_regex.

NVD description

Flask-RESTX (pypi package flask-restx) is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS (Regular Expression Denial of Service) in email_regex. This is fixed in version 0.5.1.

References

python-restx/flask-restx security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-32838 · ADVISORY
python-restx/flask-restx · WEB
python-restx/flask-restx commit bab31e0 · WEB
GitHub Advisory GHSA-3q6g-vf58-7m4g · ADVISORY
pypa/advisory-database · WEB
python-restx/flask-restx · PACKAGE
python-restx/flask-restx · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/5UCTFVDU3677B5OBGK4EF5NMUPJLL6SQ · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/QUD6SWZLX52AAZUHDETJ2CDMQGEPGFL3

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free