CVE-2023-45813: Inefficient Regular Expression Complexity in TorBot

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-10-18 · updated 2026-06-17
Weakness: CWE-1333

Description

Torbot is an open source tor network intelligence tool. In affected versions the `torbot.modules.validators.validate_link function` uses the python-validators URL validation regex. This particular regular expression has an exponential complexity which allows an attacker to cause an application crash using a well-crafted argument. An attacker can use a well-crafted URL argument to exploit the vulnerability in the regular expression and cause a Denial of Service on the system. The validators file has been removed in version 4.0.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

Torbot Project Torbot: before 4.0.0 — fixed in 4.0.0
Validators Project Validators: 0.11.0, 0.20.0

How to fix

Upgrade to a fixed version: Torbot Project Torbot 4.0.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-45813 or the next vulnerability affects your stack