What’s Vulnerable › Vulnerabilities

CVE-2020-28500: Regular Expression Denial of Service (ReDoS)

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-02-15 · updated 2026-10-08

Description

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

Affected products

• lodash: before 4.17.21 — fixed in 4.17.21
• Oracle Banking Corporate Lending Process Management: 14.2.0, 14.3.0, 14.5.0
• Oracle Banking Credit Facilities Process Management: 14.2.0, 14.3.0, 14.5.0
• Oracle Banking Extensibility Workbench: 14.2.0, 14.3.0, 14.5.0
• Oracle Banking Supply Chain Finance: 14.2.0, 14.3.0, 14.5.0
• Oracle Corporation Oracle Banking Trade Finance Process Management: 14.2.0, 14.3.0, 14.5.0
• Oracle Communications Cloud Native Core Policy: 1.11.0
• Oracle Communications Design Studio: 7.4.2
• Oracle Communications Services Gatekeeper: 7.0
• Oracle Corporation Communications Session Border Controller: 8.4, 9.0
• Oracle Corporation Enterprise Communications Broker: 3.2.0, 3.3.0
• Oracle Financial Services Crime And Compliance Management Studio: 8.0.8.2.0, 8.0.8.3.0
• Oracle Corporation Health Sciences Data Management Workbench: 2.5.2.1, 3.0.0.0
• Oracle Corporation JD Edwards EnterpriseOne Tools: before 9.2.6.1 — fixed in 9.2.6.1
• Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.58, 8.59
• Oracle Corporation Primavera Gateway: from 17.12.0 through 17.12.11; from 18.8.0 through 18.8.12; from 19.12.0 through 19.12.11; from 20.12.0 through 20.12.7
• Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 18.8, 19.12, 20.12
• Oracle Corporation Retail Customer Management and Segmentation Foundation: 19.0
• Siemens SINEC INS: before 1.0; 1.0, 1.0-sp1 — fixed in 1.0
• Npm Lodash: from 4.0.0 before 4.17.21 — fixed in 4.17.21
• Npm Lodash-Es: from 4.0.0 before 4.17.21 — fixed in 4.17.21
• Npm Lodash.Trim: from 4.0.0 through 4.5.1
• Npm Lodash.Trimend: from 4.0.0 through 4.5.1
• Rubygems Lodash-Rails: from 4.0.0 before 4.17.21; 4.0.0, 4.11.2, 4.12.0, 4.13.1, 4.14.1, 4.15.0 (+14) — fixed in 4.17.21

How to fix

Upgrade to a fixed version: lodash 4.17.21; Oracle Corporation JD Edwards EnterpriseOne Tools 9.2.6.1; Siemens SINEC INS 1.0; Npm Lodash 4.17.21; Npm Lodash-Es 4.17.21; Rubygems Lodash-Rails 4.17.21. Check the vendor advisory for mitigations.

References

• https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
• https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8
• https://github.com/lodash/lodash/pull/5065
• https://security.netapp.com/advisory/ntap-20210312-0006/
• https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893
• https://snyk.io/vuln/SNYK-JS-LODASH-1018905
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpujan2022.html

Get alerted when CVE-2020-28500 or the next vulnerability affects your stack