{"id":"CVE-2021-21252","aliases":["CLSA-2026-1773101704","DEBIAN-CVE-2021-21252","DLA-3551-1","EUVD-2021-0508","GHSA-jxwx-85vp-gvwm","UBUNTU-CVE-2021-21252"],"status":"published","title":"Regular expression denial of service in jquery-validation","description":"The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package \"jquery-validation\". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.03575,"percentile":0.89538,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2021-01-13T00:00:00Z","modified":"2026-10-23T18:03:11Z","fixes":[{"ecosystem":"npm","package":"jquery-validation","fixed_in":["1.19.3"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"jQuery.Validation","fixed_in":["1.19.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"phpmyadmin","fixed_in":["4:5.0.4+dfsg2-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"phpmyadmin","fixed_in":["4:5.0.4+dfsg2-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"phpmyadmin","fixed_in":["4:5.0.4+dfsg2-2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"jquery-validation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"jQuery.Validation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.3"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"jquery-validation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.0-tuxcare.0"},{"fixed":"1.19.0-tuxcare.1"}]}],"versions":["1.19.0"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.0.4+dfsg2-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.0.4+dfsg2-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:5.0.4+dfsg2-2"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.16-2+deb10u1"}]}],"versions":["2.0.4p01-10","2.0.4p01-11","2.0.4p01-12","2.0.4p01-13","2.0.4p01-14","2.0.4p01-14.1","2.0.4p01-15","2.0.4p01-16","2.0.4p01-17","2.0.4p01-18","2.0.4p01-6","2.0.4p01-7","2.0.4p01-8","2.0.4p01-9","2.0.99beta1-1","2.0.99beta1-2","2.1.1-1","2.1.3-1","2.1.4-1","2.1.4-2","2.1.5-1","2.1.5-2","2.1.5-3","2.1.6-1","2.1.7-1","2.1.7-2","2.2.0~beta2-1","2.2.0~beta3-1","2.2.1-1","2.2.2-1","2.2.3-1","2.2.4-1","2.2.5-1","2.2.5-2","2.2.6-1","2.2.7-1","2.2.7-2","2.2.7-2lenny1","2.2.7-2lenny2","2.2.7-2lenny3","2.2.7-3","2.3.2-1","2.3.2-2","2.3.3-1","2.3.4-1","2.3.4-2","2.3.4-3","2.3.4-4","2.3.4-5","2.3.4-6","2.3.4-7","2.4.10+dfsg1-1","2.4.10+dfsg1-2","2.4.10+dfsg1-3","2.4.5-1","2.4.5-2","2.4.5-3","2.4.5-4","2.4.5-5","2.4.6-1","2.4.6-2","2.4.7+dfsg1-1","2.4.7-1","2.4.7-2","2.4.7-3","2.4.7-4","2.4.7-5","2.4.7-6","2.4.8+dfsg1-1","2.4.9+dfsg1-1","2.4.9+dfsg1-2","2.4.9+dfsg1-3","2.4.9+dfsg1-3+squeeze1","2.4.9+dfsg1-3+squeeze3","2.4.9+dfsg1-3+squeeze4","2.4.9+dfsg1-3+squeeze5","2.4.9+dfsg1-4","2.4.9+dfsg1-5","3.0.10+dfsg1-1","3.0.10+dfsg1-2","3.0.11+dfsg1-1","3.0.8+dfsg1-1","3.0.9+dfsg1-1","3.1.0~beta4+dfsg1-1","3.1.0~beta5+dfsg1-1","3.1.0~rc1+dfsg1-1","3.1.1+dfsg1-1","3.1.1+dfsg1-2","3.1.10+dfsg1-1","3.1.11+dfsg1-1","3.1.12+dfsg1-1","3.1.12+dfsg1-2","3.1.12+dfsg1-3","3.1.2+dfsg1-1","3.1.2+dfsg1-2","3.1.2+dfsg1-3","3.1.3+dfsg1-1","3.1.3+dfsg1-2","3.1.4+dfsg1-1","3.1.5+dfsg1-1","3.1.5+dfsg1-2","3.1.5+dfsg1-3","3.1.6+dfsg1-1","3.1.7+dfsg1-1","3.1.7+dfsg1-2","3.1.7+dfsg1-3","3.1.7+dfsg1-4","3.1.7+dfsg1-5","3.1.7+dfsg1-6","3.1.7+dfsg1-7","3.1.7+dfsg1-8","3.1.8+dfsg1-1","3.1.9+dfsg1-1","3.2.1+dfsg1-1","3.2.10-1","3.2.10-2","3.2.11-1","3.2.11-1~bpo70+1","3.2.12-1","3.2.2+dfsg1-1","3.2.3+dfsg1-1","3.2.4-1","3.2.5-1","3.2.6-1","3.2.6-2","3.2.7-1","3.2.7-2","3.2.8-1","3.2.9-1","3.2.9-2","3.3.1-1","3.3.10-1","3.3.11-1","3.3.18-1~deb7u1","3.3.18-1~deb7u2","3.3.18-1~deb7u3","3.3.2-1","3.3.3-1","3.3.3-2","3.3.3-3","3.3.4-1","3.3.5-1","3.3.6-1","3.3.7-1","3.3.7-2","3.3.8-1","3.3.9-1","3.3.9-2","3.3.9-3","3.3.9-3~bpo70+1","4.0.10-1","4.0.11-1","4.0.12-1","4.0.13-1","4.0.13-1~bpo8+1","4.0.5-1","4.0.5-2","4.0.6-1","4.0.7-1","4.0.7-2","4.0.8-1","4.0.9-1","5.0.1-1","5.0.1-2","5.0.10-1","5.0.10-1~bpo8+1","5.0.11-1","5.0.12-1","5.0.13-1","5.0.13-1~bpo8+1","5.0.13-2","5.0.14-1","5.0.14-1~bpo8+1","5.0.15-1","5.0.16-1","5.0.16-1~bpo8+1","5.0.17-1","5.0.18-1","5.0.19-1","5.0.2-1","5.0.20-1","5.0.21-1","5.0.21-1~bpo9+1","5.0.22-1","5.0.23-1","5.0.23-1~bpo9+1","5.0.24-1","5.0.24-1~bpo9+1","5.0.3-1","5.0.5-1","5.0.6-1","5.0.6-1~bpo8+1","5.0.7-1","5.0.8+dfsg1-1","5.0.8-1","5.0.8-1~bpo8+1","5.0.9+dfsg1-1","5.0.9+repack1-1","6.0.1-1","6.0.10-1","6.0.11-1","6.0.11-1~bpo9+1","6.0.12-1","6.0.12-1~bpo9+1","6.0.13-1","6.0.14-1","6.0.15-1","6.0.16-1","6.0.16-2","6.0.2-1","6.0.3-1","6.0.4-1","6.0.5-1","6.0.6-1","6.0.7-1","6.0.8-1","6.0.8-1~bpo9+1","6.0.9-1","6.0.9-1~bpo9+1"],"bundled":32},{"source":"osv","ecosystem":"npm","package":"jquery-validation","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.19.3"}]}]},{"source":"osv","ecosystem":"NuGet","package":"jQuery.Validation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.3"}]}],"versions":["1.10.0","1.11.0","1.11.1","1.12.0","1.13.0","1.13.1","1.14.0","1.15.0","1.15.1","1.16.0","1.17.0","1.19.1","1.19.2","1.6.0","1.7.0","1.8.0","1.8.0.1","1.8.1","1.9.0","1.9.0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.0.6-1","4:4.0.8-1","4:4.0.9-1","4:4.0.10-1","4:4.0.10-1ubuntu0.1","4:4.0.10-1ubuntu0.1+esm1","4:4.0.10-1ubuntu0.1+esm2","4:4.0.10-1ubuntu0.1+esm3","4:4.0.10-1ubuntu0.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"civicrm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.7.1+dfsg-1","4.7.1+dfsg-2","4.7.1+dfsg-2ubuntu1","4.7.1+dfsg-2ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.10-1","5.0.1-1","5.0.1-2","5.0.2-1","5.0.3-1","5.0.5-1","5.0.6-1","5.0.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.4.13.1-1","4:4.5.0.2-2","4:4.5.1-1","4:4.5.1-2","4:4.5.1-3","4:4.5.2-1","4:4.5.2-2","4:4.5.3.1-1","4:4.5.4-1","4:4.5.4.1-2","4:4.5.4.1-2ubuntu1","4:4.5.4.1-2ubuntu2","4:4.5.4.1-2ubuntu2.1","4:4.5.4.1-2ubuntu2.1+esm2","4:4.5.4.1-2ubuntu2.1+esm3","4:4.5.4.1-2ubuntu2.1+esm4","4:4.5.4.1-2ubuntu2.1+esm5","4:4.5.4.1-2ubuntu2.1+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"civicrm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.7.23+dfsg-1ubuntu1","4.7.24+dfsg-1ubuntu1","4.7.30+dfsg-1ubuntu1","4.7.30+dfsg-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.23-1","5.0.24-1","6.0.1-1","6.0.2-1","6.0.3-1","6.0.4-1","6.0.5-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.6.6-5","4:4.6.6-5ubuntu0.2+esm1","4:4.6.6-5ubuntu0.2+esm2","4:4.6.6-5ubuntu0.5","4:4.6.6-5ubuntu0.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"civicrm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0+dfsg-1","5.18.1+dfsg-1","5.20.3+dfsg-1","5.21.0+dfsg-1","5.21.1+dfsg-1","5.21.2+dfsg-1","5.21.2+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.20-1","6.0.23-2","6.0.24-1","6.0.25-1","6.0.25-2","6.0.25-3","6.0.26-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"phpmyadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:4.9.1+dfsg1-2","4:4.9.2+dfsg1-1","4:4.9.5+dfsg1-1ubuntu1","4:4.9.5+dfsg1-2","4:4.9.5+dfsg1-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"otrs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.32-6","6.1.2-1","6.2.1-1","6.2.2-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"civicrm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.33.2+dfsg1-1","5.33.2+dfsg1-1build1","5.33.2+dfsg1-1ubuntu1","5.33.2+dfsg1-1ubuntu1+esm1"]}],"products":[{"vendor":"jquery-validation","product":"jquery-validation"},{"vendor":"jqueryvalidation","product":"jquery_validation"},{"vendor":"netapp","product":"snapcenter"}],"references":[{"url":"https://github.com/jquery-validation/jquery-validation/security/advisories/GHSA-jxwx-85vp-gvwm","tags":["x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/jquery-validation/jquery-validation/pull/2371","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/jquery-validation/jquery-validation/commit/5d8f29eef363d043a8fec4eb86d42cadb5fa5f7d","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.npmjs.com/package/jquery-validation","tags":["x_transferred","Product","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210219-0005/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21252","tags":["advisory"]},{"url":"https://jqueryvalidation.org/#installation-via-package-managers","tags":["web"]},{"url":"https://securitylab.github.com/advisories/GHSL-2020-294-redos-jquery-validation/"},{"url":"https://www.nuget.org/packages/jquery.validation","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jxwx-85vp-gvwm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-21252","tags":["advisory"]},{"url":"https://github.com/jquery-validation/jquery-validation","tags":["package"]},{"url":"https://security.netapp.com/advisory/ntap-20210219-0005","tags":["web"]},{"url":"https://securitylab.github.com/advisories/GHSL-2020-294-redos-jquery-validation","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-21252","tags":["report"]},{"url":"https://github.com/phpmyadmin/phpmyadmin/commit/401eedd288c4e83d69287b97a9f574f231156171","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21252","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-21252","title":"Regular expression denial of service in jquery-validation","description":"The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package \"jquery-validation\". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3.","status":"published","published":"2021-01-13T00:00:00Z","modified":"2024-08-03T18:09:14.663Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:33:00.137099Z"}],"euvd":[{"id":"EUVD-2021-0508","description":"The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package \"jquery-validation\". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3.","status":"published","published":"2021-01-13T00:00:00Z","modified":"2024-08-03T18:09:14Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T03:25:06.913643Z"}],"ghsa":[{"id":"GHSA-jxwx-85vp-gvwm","title":"Regular Expression Denial of Service in jquery-validation","description":"The GitHub Security Lab team has identified potential security vulnerabilities in jquery.validation.\n\nThe project contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service)\n\nThis issue was discovered and reported by GitHub team member @erik-krogh (Erik Krogh Kristensen).","status":"published","published":"2021-01-13T18:21:54Z","modified":"2023-08-31T18:35:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:02.095916Z"}],"nvd":[{"id":"CVE-2021-21252","description":"The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package \"jquery-validation\". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3.","status":"published","published":"2021-01-13T19:15:17.183Z","modified":"2026-06-17T03:35:07.967Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:06:49.284888Z"}],"osv":[{"id":"CVE-2021-21252","description":"The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package \"jquery-validation\". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3.","status":"published","published":"2021-01-13T19:15:17.183Z","modified":"2026-10-20T10:54:27.666142894Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.004149Z"},{"id":"DEBIAN-CVE-2021-21252","description":"The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package \"jquery-validation\". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3.","status":"published","published":"2021-01-13T19:15:17.183Z","modified":"2026-10-23T18:03:11.327231554Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"GHSA-jxwx-85vp-gvwm","title":"Regular Expression Denial of Service in jquery-validation","description":"The GitHub Security Lab team has identified potential security vulnerabilities in jquery.validation.\n\nThe project contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service)\n\nThis issue was discovered and reported by GitHub team member @erik-krogh (Erik Krogh Kristensen).","status":"published","published":"2021-01-13T18:21:54Z","modified":"2026-07-08T06:29:20.727643255Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:51.10002Z"},{"id":"UBUNTU-CVE-2021-21252","description":"The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package \"jquery-validation\". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3.","status":"published","published":"2021-01-13T19:15:00Z","modified":"2026-05-08T12:25:19.573499Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.29421Z"},{"id":"CLSA-2026-1773101704","title":"TuxCare security update for jquery-validation (4 CVEs)","description":"TuxCare rebuilt jquery-validation to address 4 CVEs. Fixed in 1.19.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:11Z","modified":"2026-10-15T09:47:27.601890925Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"DLA-3551-1","title":"otrs2 - security update","status":"published","published":"2023-08-31T00:00:00Z","modified":"2026-03-09T01:23:23.492308Z","updated_at":"2026-11-02T15:46:11.734021Z"}]}}