CVE-2017-16115
Regular Expression Denial of Service in timespan
The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around 10 seconds.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around 10 seconds.
- Record
CVE-2017-16115- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE List No score
The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around 10 seconds.
- Record
CVE-2017-16115- Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2018-0395 No score
The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around 10 seconds.
- Record
EUVD-2018-0395- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f523-2f5j-gfcg
Regular Expression Denial of Service in timespan
Affected versions of timespan are vulnerable to a regular expression denial of service when parsing dates.
The amplification for this vulnerability is significant, with 50,000 characters resulting in the event loop being blocked for around 10 seconds.
Recommendation
No direct patch is available for this vulnerability.
Currently, the best available solution is to use a functionally equivalent alternative package.
It is also sufficient to ensure that user input is not being passed into timespan, or that the maximum length of such user input is drastically reduced. Limiting the input length to 150 characters should be sufficient in most cases.
- Record
GHSA-f523-2f5j-gfcg- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-f523-2f5j-gfcg
Regular Expression Denial of Service in timespan
Affected versions of timespan are vulnerable to a regular expression denial of service when parsing dates.
The amplification for this vulnerability is significant, with 50,000 characters resulting in the event loop being blocked for around 10 seconds.
Recommendation
No direct patch is available for this vulnerability.
Currently, the best available solution is to use a functionally equivalent alternative package.
It is also sufficient to ensure that user input is not being passed into timespan, or that the maximum length of such user input is drastically reduced. Limiting the input length to 150 characters should be sufficient in most cases.
- Record
GHSA-f523-2f5j-gfcg- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVCLSA-2026-1777336758 No score
TuxCare security update for timespan (1 CVE)
TuxCare rebuilt timespan to address 1 CVE. Fixed in 2.3.0-tuxcare.1.
- Record
CLSA-2026-1777336758- Updated
- 2026-11-02
OSVCLSA-2026-1786539981 No score
TuxCare security update for dompurify (10 CVEs)
TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 2.3.0-tuxcare.1.
- Record
CLSA-2026-1786539981- Updated
- 2026-11-02
OSVCLSA-2026-1793867539 No score
TuxCare security update for timespan (1 CVE)
TuxCare rebuilt timespan to address 1 CVE. Fixed in 2.3.0-tuxcare.2.
- Record
CLSA-2026-1793867539- Updated
- 2026-11-05
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts | OSV | |
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-16115 is a high vulnerability (CVSS 7.5) in Timespan Project Timespan, published June 7, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.48%, the 74th percentile. Fixed in timespan 2.3.0-tuxcare.1.