description: This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
problem types: Regular Expression Denial of Service (ReDoS)
affected:
{
product: http-cache-semantics
versions:
version: 0, lessThan: 4.1.1, status: affected, versionType: semver
vendor: n/a
}
{
product: org.webjars.npm:http-cache-semantics
versions:
version: 0, lessThan: 4.1.1, status: affected, versionType: semver
vendor: n/a
}
metrics:
cvssV3_1: [
version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
]