What’s Vulnerable › Vulnerabilities

CVE-2022-24729: Regular expression Denial of Service in dialog plugin

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-16 · updated 2026-06-17
• Weakness: CWE-400

Description

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.

Affected products

• ckeditor4: from 4.0 before 4.18.0 — fixed in 4.18.0
• Drupal: from 8.0.0 before 9.2.15; from 9.3.0 before 9.3.8 — fixed in 9.2.15, 9.3.8
• Fedoraproject Fedora: 36, 37
• Oracle Corporation Application Express: before 22.1.1 — fixed in 22.1.1
• Oracle Corporation Commerce Merchandising: 11.3.2
• Oracle Corporation Financial Services Analytical Applications Infrastructure: from 8.0.7.0.0 through 8.1.0.0.0; 8.1.1.0, 8.1.2.0, 8.1.2.1
• Oracle Corporation Financial Services Behavior Detection Platform: from 8.1.1.0 through 8.1.2.1; 8.0.7.0, 8.0.8.0
• Oracle Financial Services Trade-Based Anti Money Laundering: 8.0.7, 8.0.8
• Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.58, 8.59

How to fix

Upgrade to a fixed version: ckeditor4 4.18.0; Drupal 9.2.15, 9.3.8; Oracle Corporation Application Express 22.1.1. Check the vendor advisory for mitigations.

References

• https://ckeditor.com/cke4/release/CKEditor-4.18.0
• https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-f6rf-9m92-x2hh
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/
• https://www.drupal.org/sa-core-2022-005
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://ckeditor.com/cke4/release/CKEditor-4.18.0
• https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-f6rf-9m92-x2hh
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VR76VBN5GW5QUBJFHVXRX36UZ6YTCMW6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOZGMCYDB2OKKULFXZKM6V7JJW4ZZHJP/
• https://www.drupal.org/sa-core-2022-005
• https://www.oracle.com/security-alerts/cpujul2022.html

Get alerted when CVE-2022-24729 or the next vulnerability affects your stack