What’s Vulnerable › Vulnerabilities

CVE-2021-32832: ReDOS in Rocket.Chat

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-08-30 · updated 2026-06-17
• Weakness: CWE-400

Description

Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript. In Rocket.Chat before versions 3.11.3, 3.12.2, and 3.13 an issue with certain regular expressions could lead potentially to Denial of Service. This was fixed in versions 3.11.3, 3.12.2, and 3.13.

Affected products

• Rocket.Chat: before 3.11.3; from 3.12.0 before 3.12.2 — fixed in 3.11.3, 3.12.2

How to fix

Upgrade to a fixed version: Rocket.Chat 3.11.3, 3.12.2. Check the vendor advisory for mitigations.

References

• https://docs.rocket.chat/guides/security/security-updates
• https://github.com/RocketChat/Rocket.Chat/commit/4a0dce973e37ec3f56ca2231d6030511dbdd094c
• https://github.com/RocketChat/Rocket.Chat/releases/tag/3.11.3
• https://securitylab.github.com/advisories/GHSL-2020-310-redos-Rocket.Chat/
• https://docs.rocket.chat/guides/security/security-updates
• https://github.com/RocketChat/Rocket.Chat/commit/4a0dce973e37ec3f56ca2231d6030511dbdd094c
• https://github.com/RocketChat/Rocket.Chat/releases/tag/3.11.3
• https://securitylab.github.com/advisories/GHSL-2020-310-redos-Rocket.Chat/

Get alerted when CVE-2021-32832 or the next vulnerability affects your stack