Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
Related vulnerabilities
BREW-JUPYTERLAB-CVE-2020-6817 (GHSA-VQHP-CXGC-6WMM)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:01 – Updated: 2026-09-17 19:02 – Source website
VLAI
Summary
regular expression denial-of-service (ReDoS) in Bleach
Details
Impact
bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS).
Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
Patches
3.1.4
Workarounds
-
do not whitelist the style attribute in
bleach.cleancalls -
limit input string length
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1623633
- https://www.regular-expressions.info/redos.html
- https://blog.r2c.dev/posts/finding-python-redos-bugs-at-scale-using-dlint-and-r2c/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6817
Credits
- Reported by schwag09 of r2c
For more information
If you have any questions or comments about this advisory:
- Open an issue at https://github.com/mozilla/bleach/issues
- Email us at security@mozilla.org
Severity
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "bleach",
"resource_purl": "pkg:pypi/bleach@6.4.0",
"upstream_fixed_in": "3.1.4"
},
"package": {
"ecosystem": "Homebrew",
"name": "jupyterlab",
"purl": "pkg:brew/jupyterlab"
},
"ranges": [
{
"events": [
{
"introduced": "1.2.0"
},
{
"fixed": "2.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/bleach@6.4.0",
"name": "bleach",
"resource": "bleach",
"strategy": "registry",
"subject_version": "6.4.0"
}
]
},
"details": "### Impact\n\n`bleach.clean` behavior parsing style attributes could result in a regular expression denial of service (ReDoS).\n\nCalls to ``bleach.clean`` with an allowed tag with an allowed ``style`` attribute are vulnerable to ReDoS. For example, ``bleach.clean(..., attributes={\u0027a\u0027: [\u0027style\u0027]})``.\n\n### Patches\n\n3.1.4\n\n### Workarounds\n\n* do not whitelist the style attribute in `bleach.clean` calls\n\n* limit input string length\n\n### References\n\n* https://bugzilla.mozilla.org/show_bug.cgi?id=1623633\n* https://www.regular-expressions.info/redos.html\n* https://blog.r2c.dev/posts/finding-python-redos-bugs-at-scale-using-dlint-and-r2c/\n* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6817\n\n### Credits\n\n* Reported by schwag09 of r2c\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Open an issue at https://github.com/mozilla/bleach/issues\n* Email us at security@mozilla.org",
"id": "BREW-jupyterlab-CVE-2020-6817",
"modified": "2026-09-17T19:02:18Z",
"published": "2026-08-13T17:01:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mozilla/bleach/security/advisories/GHSA-vqhp-cxgc-6wmm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6817"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1623633"
},
{
"type": "PACKAGE",
"url": "https://github.com/mozilla/bleach"
},
{
"type": "WEB",
"url": "https://github.com/mozilla/bleach/releases/tag/v3.1.4"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/bleach/PYSEC-2020-340.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-BLEACH-561754"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "regular expression denial-of-service (ReDoS) in Bleach",
"upstream": [
"GHSA-vqhp-cxgc-6wmm",
"CVE-2020-6817",
"PYSEC-2020-340",
"SNYK-PYTHON-BLEACH-561754"
]
}
BREW-RESTVIEW-CVE-2020-6817 (GHSA-VQHP-CXGC-6WMM)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:32 – Updated: 2026-09-10 01:05 – Source website
VLAI
Summary
regular expression denial-of-service (ReDoS) in Bleach
Details
Impact
bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS).
Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
Patches
3.1.4
Workarounds
-
do not whitelist the style attribute in
bleach.cleancalls -
limit input string length
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1623633
- https://www.regular-expressions.info/redos.html
- https://blog.r2c.dev/posts/finding-python-redos-bugs-at-scale-using-dlint-and-r2c/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6817
Credits
- Reported by schwag09 of r2c
For more information
If you have any questions or comments about this advisory:
- Open an issue at https://github.com/mozilla/bleach/issues
- Email us at security@mozilla.org
Severity
References
| URL | Type | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "bleach",
"resource_purl": "pkg:pypi/bleach@6.4.0",
"upstream_fixed_in": "3.1.4"
},
"package": {
"ecosystem": "Homebrew",
"name": "restview",
"purl": "pkg:brew/restview"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.2_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/bleach@6.4.0",
"name": "bleach",
"resource": "bleach",
"strategy": "registry",
"subject_version": "6.4.0"
}
]
},
"details": "### Impact\n\n`bleach.clean` behavior parsing style attributes could result in a regular expression denial of service (ReDoS).\n\nCalls to ``bleach.clean`` with an allowed tag with an allowed ``style`` attribute are vulnerable to ReDoS. For example, ``bleach.clean(..., attributes={\u0027a\u0027: [\u0027style\u0027]})``.\n\n### Patches\n\n3.1.4\n\n### Workarounds\n\n* do not whitelist the style attribute in `bleach.clean` calls\n\n* limit input string length\n\n### References\n\n* https://bugzilla.mozilla.org/show_bug.cgi?id=1623633\n* https://www.regular-expressions.info/redos.html\n* https://blog.r2c.dev/posts/finding-python-redos-bugs-at-scale-using-dlint-and-r2c/\n* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6817\n\n### Credits\n\n* Reported by schwag09 of r2c\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Open an issue at https://github.com/mozilla/bleach/issues\n* Email us at security@mozilla.org",
"id": "BREW-restview-CVE-2020-6817",
"modified": "2026-09-10T01:05:59Z",
"published": "2026-08-13T17:32:31Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mozilla/bleach/security/advisories/GHSA-vqhp-cxgc-6wmm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6817"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1623633"
},
{
"type": "PACKAGE",
"url": "https://github.com/mozilla/bleach"
},
{
"type": "WEB",
"url": "https://github.com/mozilla/bleach/releases/tag/v3.1.4"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/bleach/PYSEC-2020-340.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-BLEACH-561754"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "regular expression denial-of-service (ReDoS) in Bleach",
"upstream": [
"GHSA-vqhp-cxgc-6wmm",
"CVE-2020-6817",
"PYSEC-2020-340",
"SNYK-PYTHON-BLEACH-561754"
]
}
PYSEC-2020-340
Vulnerability from pysec - Published: 2020-03-30 19:45 - Updated: 2022-01-05 02:16
VLAI
Details
In Mozilla Bleach before 3.1.4, bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS).
Impacted products
| Name | purl | bleach | pkg:pypi/bleach |
|---|
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "bleach",
"purl": "pkg:pypi/bleach"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.1",
"0.1.1",
"0.1.2",
"0.2",
"0.2.1",
"0.2.2",
"0.3",
"0.3.1",
"0.3.3",
"0.3.4",
"0.5.0",
"0.5.1",
"1.0.0",
"1.0.1",
"1.0.2",
"1.0.3",
"1.0.4",
"1.1.0",
"1.1.1",
"1.1.2",
"1.1.3",
"1.1.4",
"1.1.5",
"1.2",
"1.2.1",
"1.2.2",
"1.4",
"1.4.1",
"1.4.2",
"1.4.3",
"1.5.0",
"2.0.0",
"2.1",
"2.1.1",
"2.1.2",
"2.1.3",
"2.1.4",
"3.0.0",
"3.0.1",
"3.0.2",
"3.1.0",
"3.1.1",
"3.1.2",
"3.1.3"
]
}
],
"aliases": [
"CVE-2020-6817",
"GHSA-vqhp-cxgc-6wmm",
"SNYK-PYTHON-BLEACH-561754"
],
"details": "In Mozilla Bleach before 3.1.4, `bleach.clean` behavior parsing style attributes could result in a regular expression denial of service (ReDoS).",
"id": "PYSEC-2020-340",
"modified": "2022-01-05T02:16:12.945364Z",
"published": "2020-03-30T19:45:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/mozilla/bleach/security/advisories/GHSA-vqhp-cxgc-6wmm"
},
{
"type": "ARTICLE",
"url": "https://blog.r2c.dev/posts/finding-python-redos-bugs-at-scale-using-dlint-and-r2c/"
},
{
"type": "REPORT",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1623633"
},
{
"type": "WEB",
"url": "https://github.com/mozilla/bleach/releases/tag/v3.1.4"
},
{
"type": "ADVISORY",
"url": "https://snyk.io/vuln/SNYK-PYTHON-BLEACH-561754"
}
]
}