{"id":"GHSA-3xq5-wjfh-ppjc","summary":"Luxon Inefficient Regular Expression Complexity vulnerability","details":"# Impact\nLuxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks.\n\nThis is the same bug as Moment's https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g\n\n# Workarounds\nLimit the length of the input.\n\n# References\nThere is an excellent writeup of the same issue in Moment: https://github.com/moment/moment/pull/6015#issuecomment-1152961973\n\n# Details\n`DateTime.fromRFC2822(\"(\".repeat(500000))` takes a couple minutes to complete.","aliases":["CVE-2023-22467"],"modified":"2026-03-11T07:48:06.376042Z","published":"2023-01-09T14:10:49Z","related":["CVE-2023-22467"],"database_specific":{"github_reviewed":true,"github_reviewed_at":"2023-01-09T14:10:49Z","nvd_published_at":"2023-01-04T22:15:00Z","cwe_ids":["CWE-1333"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/moment/luxon/security/advisories/GHSA-3xq5-wjfh-ppjc"},{"type":"WEB","url":"https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22467"},{"type":"WEB","url":"https://github.com/moment/moment/pull/6015#issuecomment-1152961973"},{"type":"WEB","url":"https://github.com/moment/luxon/commit/5ab3bf64a10da929a437629cdb2f059bb83212bf"},{"type":"PACKAGE","url":"https://github.com/moment/luxon"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/44I3WAJKYXDLOVYRGMHAUXMIV4SPFXDZ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4LIVOASKBQH7FEUI5RWM3SOHR6VK7ZZR"}],"affected":[{"package":{"name":"luxon","ecosystem":"npm","purl":"pkg:npm/luxon"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.28.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-3xq5-wjfh-ppjc/GHSA-3xq5-wjfh-ppjc.json"}},{"package":{"name":"luxon","ecosystem":"npm","purl":"pkg:npm/luxon"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.5.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-3xq5-wjfh-ppjc/GHSA-3xq5-wjfh-ppjc.json"}},{"package":{"name":"luxon","ecosystem":"npm","purl":"pkg:npm/luxon"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.2.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-3xq5-wjfh-ppjc/GHSA-3xq5-wjfh-ppjc.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}