description: This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service.
**Note:**
This package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core).
problem types: Regular Expression Denial of Service (ReDoS)
affected:
{
product: angular
versions:
version: 1.3.0, lessThan: *, status: affected, versionType: semver
vendor: n/a
}
{
product: org.webjars.bower:angular
versions:
version: 1.3.0, lessThan: *, status: affected, versionType: semver
vendor: n/a
}
{
product: org.webjars.npm:angular
versions:
version: 1.3.0, lessThan: *, status: affected, versionType: semver
vendor: n/a
}
metrics:
cvssV3_1: [
version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P
]