CVE-2020-7760: Regular Expression Denial of Service (ReDoS)

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-10-30 · updated 2026-06-17
Weakness: CWE-400

Description

This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/*.*?*/)*

Affected products

Codemirror: before 5.58.2 — fixed in 5.58.2
Oracle Corporation Application Express: before 20.2 — fixed in 20.2
Oracle Enterprise Manager Express User Interface: 19c
Oracle Corporation Oracle Essbase: 21.2
Oracle Corporation Oracle Hyperion Data Relationship Management: before 11.2.9.0 — fixed in 11.2.9.0
Oracle Spatial Studio: before 19.1.0 — fixed in 19.1.0

How to fix

Upgrade to a fixed version: Codemirror 5.58.2; Oracle Corporation Application Express 20.2; Oracle Corporation Oracle Hyperion Data Relationship Management 11.2.9.0; Oracle Spatial Studio 19.1.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-7760 or the next vulnerability affects your stack