{"id":"CVE-2017-15010","aliases":["CLSA-2026-1772583199","CLSA-2026-1773101696","CLSA-2026-1774225211","CLSA-2026-1784596273","CLSA-2026-1792164090","CLSA-2026-1792164172","DEBIAN-CVE-2017-15010","EUVD-2018-0269","GHSA-g7q5-pjjr-gqvp","RHSA-2017:2912","RHSA-2017:2913","RHSA-2018:1263","UBUNTU-CVE-2017-15010"],"status":"published","title":"Regular Expression Denial of Service in tough-cookie","description":"A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03283,"percentile":0.88533,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2017-10-03T16:00:00Z","modified":"2026-10-20T10:48:13Z","fixes":[{"ecosystem":"npm","package":"tough-cookie","fixed_in":["2.3.3"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"tough-cookie","fixed_in":["2.3.2-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-tough-cookie","fixed_in":["2.3.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-tough-cookie","fixed_in":["2.3.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-tough-cookie","fixed_in":["2.3.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-nodejs6-nodejs-tough-cookie","fixed_in":["0:2.3.3-1.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-nodejs6-nodejs-tough-cookie","fixed_in":["0:2.3.3-1.el7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"tough-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"tough-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.1-tuxcare.0"},{"fixed":"0.12.1-tuxcare.1"}]}],"versions":["0.12.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"tough-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0-tuxcare.0"},{"fixed":"2.2.0-tuxcare.1"}]}],"versions":["2.2.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"tough-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0-tuxcare.0"},{"fixed":"1.2.0-tuxcare.1"}]}],"versions":["1.2.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"tough-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.2-tuxcare.0"},{"fixed":"2.2.2-tuxcare.1"}]}],"versions":["2.2.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"tough-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.1-tuxcare.0"},{"fixed":"2.2.1-tuxcare.1"}]}],"versions":["2.2.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"tough-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.2-tuxcare.0"},{"fixed":"2.3.2-tuxcare.1"}]}],"versions":["2.3.2"]},{"source":"osv","ecosystem":"Debian:12","package":"node-tough-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-tough-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-tough-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"npm","package":"tough-cookie","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.3.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-nodejs4-nodejs-tough-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-nodejs4-nodejs-tough-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-nodejs6-nodejs-tough-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-1.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-nodejs6-nodejs-tough-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.3-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"fh-system-dump-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-5.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"fping","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10-4.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"fping-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10-4.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.8-8.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.8-8.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.8-8.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.8-8.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-breeze","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-by_ssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-dbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-dhcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-dig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-disk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-disk_smb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-dummy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-file_age","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-flexlm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-fping","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-game","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-hpjd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-icmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-ide_smart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-ifoperstatus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-ifstatus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-ircd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-load","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-log","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-mailq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-mrtg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-mrtgtraf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-nagios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-nt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-ntp-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-nwstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-oracle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-overcr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-ping","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-procs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-radius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-real","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-rpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-sensors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-ssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-swap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-tcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-time","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-ups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-uptime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-users","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"nagios-plugins-wave","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"perl-Crypt-CBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.33-2.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"perl-Crypt-DES","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.05-20.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"perl-Crypt-DES-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.05-20.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"perl-Net-SNMP","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-7.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"phantomjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.7-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"phantomjs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.7-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"python-meld3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.10-1.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"python-meld3-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.10-1.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"qstat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-13.20080912svn311.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"qstat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.11-13.20080912svn311.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"radiusclient-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.6-9.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"radiusclient-ng-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.6-9.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"radiusclient-ng-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.6-9.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"radiusclient-ng-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.6-9.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.21-2.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"redis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.21-2.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"rhmap-fh-openshift-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.0-5.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"rhmap-mod_authnz_external","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-7.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"rhmap-mod_authnz_external-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-7.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"sendEmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.56-2.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"ssmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.64-14.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"ssmtp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.64-14.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:mobile_application_platform:4.6","package":"supervisor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-3.el7map"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-tough-cookie","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.2+dfsg-1"]}],"products":[{"vendor":"salesforce","product":"tough-cookie"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2017:2913","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nodesecurity.io/advisories/525","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","article","report"]},{"url":"http://www.securityfocus.com/bid/101185","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1264","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2912","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1263","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/salesforce/tough-cookie/issues/92","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://snyk.io/vuln/npm:tough-cookie:20170905","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6VEBDTGNHVM677SLZDEHMWOP3ISMZSFT/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15010","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g7q5-pjjr-gqvp","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/525","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6VEBDTGNHVM677SLZDEHMWOP3ISMZSFT/"},{"url":"https://github.com/salesforce/tough-cookie/commit/f1ed420a6a92ea7a5418df6e39e676556bc0c71d","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-15010","tags":["advisory"]},{"url":"https://github.com/salesforce/tough-cookie","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6VEBDTGNHVM677SLZDEHMWOP3ISMZSFT","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1359818","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1493989","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2912.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1000232","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1000232","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1000232","tags":["advisory"]},{"url":"https://nodesecurity.io/advisories/130","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15010","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15010","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2913.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1545893","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHMAP-19902","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1263.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-3728","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-3728","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-3728","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-15010","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-15010","description":"A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.","status":"published","published":"2017-10-03T16:00:00Z","modified":"2024-08-05T19:42:22.357Z","updated_at":"2026-11-02T14:33:14.271248Z"}],"euvd":[{"id":"EUVD-2018-0269","description":"A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.","status":"published","published":"2017-10-03T16:00:00Z","modified":"2024-08-05T19:42:22Z","updated_at":"2026-11-03T02:23:15.298105Z"}],"ghsa":[{"id":"GHSA-g7q5-pjjr-gqvp","title":"Regular Expression Denial of Service in tough-cookie","description":"Affected versions of `tough-cookie` are susceptible to a regular expression denial of service.\n\nThe amplification on this vulnerability is relatively low - it takes around 2 seconds for the engine to execute on a malicious input which is 50,000 characters in length.\n\nIf node was compiled using the `-DHTTP_MAX_HEADER_SIZE` however, the impact of the vulnerability can be significant, as the primary limitation for the vulnerability is the default max HTTP header length in node.\n\n\n## Recommendation\n\nUpdate to version 2.3.3 or later.","status":"published","published":"2018-07-24T20:14:39Z","modified":"2023-11-29T22:31:23Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:23.843848Z"}],"nvd":[{"id":"CVE-2017-15010","description":"A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.","status":"published","published":"2017-10-04T01:29:03.403Z","modified":"2026-06-17T01:07:07.63Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:04:01.734197Z"}],"osv":[{"id":"CVE-2017-15010","description":"A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.","status":"published","published":"2017-10-04T01:29:03.403Z","modified":"2026-10-20T10:48:13.224284211Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.572713Z"},{"id":"DEBIAN-CVE-2017-15010","description":"A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.","status":"published","published":"2017-10-04T01:29:03.403Z","modified":"2026-09-01T20:03:04.556201324Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.801885Z"},{"id":"GHSA-g7q5-pjjr-gqvp","title":"Regular Expression Denial of Service in tough-cookie","description":"Affected versions of `tough-cookie` are susceptible to a regular expression denial of service.\n\nThe amplification on this vulnerability is relatively low - it takes around 2 seconds for the engine to execute on a malicious input which is 50,000 characters in length.\n\nIf node was compiled using the `-DHTTP_MAX_HEADER_SIZE` however, the impact of the vulnerability can be significant, as the primary limitation for the vulnerability is the default max HTTP header length in node.\n\n\n## Recommendation\n\nUpdate to version 2.3.3 or later.","status":"published","published":"2018-07-24T20:14:39Z","modified":"2023-11-08T03:58:56.101045Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"RHSA-2017:2912","title":"Red Hat Security Advisory: rh-nodejs4-nodejs-tough-cookie security update","status":"published","published":"2024-09-13T13:38:47Z","modified":"2026-06-29T10:18:00Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2017:2913","title":"Red Hat Security Advisory: rh-nodejs6-nodejs-tough-cookie security update","status":"published","published":"2024-09-13T13:38:51Z","modified":"2026-06-29T10:18:00Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:1263","title":"Red Hat Security Advisory: Red Hat Mobile Application Platform 4.6.0 release - RPMs","status":"published","published":"2024-09-14T00:39:21Z","modified":"2026-06-29T10:20:01Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"UBUNTU-CVE-2017-15010","description":"A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.","status":"published","published":"2017-10-04T01:29:00Z","modified":"2025-10-24T04:46:32Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.563448Z"},{"id":"CLSA-2026-1772583199","title":"TuxCare security update for tough-cookie (3 CVEs)","description":"TuxCare rebuilt tough-cookie to address 3 CVEs. Fixed in 0.12.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:10Z","modified":"2026-10-15T09:46:59.609463444Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773101696","title":"TuxCare security update for tough-cookie (3 CVEs)","description":"TuxCare rebuilt tough-cookie to address 3 CVEs. Fixed in 2.2.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:11Z","modified":"2026-10-15T09:45:26.577272543Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1774225211","title":"TuxCare security update for tough-cookie (3 CVEs)","description":"TuxCare rebuilt tough-cookie to address 3 CVEs. Fixed in 1.2.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:47:48.077352929Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1784596273","title":"TuxCare security update for tough-cookie (2 CVEs)","description":"TuxCare rebuilt tough-cookie to address 2 CVEs. Fixed in 2.2.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:45Z","modified":"2026-10-15T09:47:52.478880674Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1792164090","title":"TuxCare security update for tough-cookie (3 CVEs)","description":"TuxCare rebuilt tough-cookie to address 3 CVEs. Fixed in 2.2.1-tuxcare.1.","status":"published","published":"2026-10-16T15:21:30Z","modified":"2026-10-16T16:30:12.026302617Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792164172","title":"TuxCare security update for tough-cookie (1 CVE)","description":"TuxCare rebuilt tough-cookie to address 1 CVE. Fixed in 2.3.2-tuxcare.1.","status":"published","published":"2026-10-16T15:22:52Z","modified":"2026-10-16T16:32:00.373258585Z","updated_at":"2026-11-02T15:43:51.747192Z"}]}}