What’s Vulnerable › Vulnerabilities
CVE-2020-28493: Regular Expression Denial of Service (ReDoS)
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 3.5% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2021-02-01 · updated 2026-06-17
- Weakness: CWE-400
Description
This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.
Affected products
- Fedoraproject Fedora: 33
- pallets jinja: before 2.11.3 — fixed in 2.11.3
- Pypi Jinja2: before 2.11.3; 2.0rc1, 2.0, 2.1, 2.1.1, 2.2, 2.2.1 (+31) — fixed in 2.11.3
How to fix
Upgrade to a fixed version: pallets jinja 2.11.3; Pypi Jinja2 2.11.3. Check the vendor advisory for mitigations.
References
- https://github.com/pallets/jinja/blob/ab81fd9c277900c85da0c322a2ff9d68a235b2e6/src/jinja2/utils.py%23L20
- https://github.com/pallets/jinja/pull/1343
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVAKCOO7VBVUBM3Q6CBBTPBFNP5NDXF4/
- https://security.gentoo.org/glsa/202107-19
- https://snyk.io/vuln/SNYK-PYTHON-JINJA2-1012994
- https://github.com/pallets/jinja/blob/ab81fd9c277900c85da0c322a2ff9d68a235b2e6/src/jinja2/utils.py%23L20
- https://github.com/pallets/jinja/pull/1343
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVAKCOO7VBVUBM3Q6CBBTPBFNP5NDXF4/
- https://security.gentoo.org/glsa/202107-19
- https://snyk.io/vuln/SNYK-PYTHON-JINJA2-1012994
Get alerted when CVE-2020-28493 or the next vulnerability affects your stack