What’s Vulnerable › Vulnerabilities

CVE-2021-32848: Octobox ReDoS vulnerability

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-02-20 · updated 2026-06-17
• Weakness: CWE-770

Description

Octobox is software for managing GitHub notifications. Prior to pull request (PR) 2807, a user of the system can provide a specifically crafted search query string that will trigger a ReDoS vulnerability. This issue is fixed in PR 2807.

Affected products

• octobox: before 2021-11-02 — fixed in 2021-11-02

How to fix

Upgrade to a fixed version: octobox 2021-11-02. Check the vendor advisory for mitigations.

References

• https://github.com/octobox/octobox/blob/372a0da981dbf47319fed4116364118fdf09fcc3/lib/search_parser.rb#L5
• https://github.com/octobox/octobox/pull/2807
• https://securitylab.github.com/advisories/GHSL-2021-100-octobox-octobox/
• https://github.com/octobox/octobox/blob/372a0da981dbf47319fed4116364118fdf09fcc3/lib/search_parser.rb#L5
• https://github.com/octobox/octobox/pull/2807
• https://securitylab.github.com/advisories/GHSL-2021-100-octobox-octobox/

Get alerted when CVE-2021-32848 or the next vulnerability affects your stack