{"id":"CVE-2021-27293","aliases":["EUVD-2021-1455","GHSA-9pq7-rcxv-47vq"],"status":"published","title":"Incorrect Regular Expression in RestSharp","description":"RestSharp \u003c 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTimes. If a server responds with a malicious string, the client using RestSharp will be stuck processing it for an exceedingly long time. Thus the remote server can trigger Denial of Service.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01508,"percentile":0.74599,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-185","CWE-697"],"published":"2021-07-12T10:47:01Z","modified":"2026-10-20T10:54:35Z","fixes":[{"ecosystem":"NuGet","package":"RestSharp","fixed_in":["106.11.8-alpha.0.13"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"RestSharp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"106.11.7"},{"fixed":"106.11.8-alpha.0.13"}]}]},{"source":"osv","ecosystem":"NuGet","package":"RestSharp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"106.11.8-alpha.0.13"}]}],"versions":["1.0.0","100.3.0","101.0.0","101.1.0","101.2.0","101.3.0","102.0.0","102.1.0","102.2.0","102.3.0","102.4.0","102.5.0","102.6.0","102.7.0","103.0.0","103.0.0-nojsondotnet","103.1.0","103.1.0-beta","103.2.0","103.3.0","103.4.0","104.0.0","104.1.0","104.2.0","104.2.0-beta","104.3.0-beta","104.3.1-beta","104.3.3","104.3.3-beta","104.4.0","104.4.0-beta","104.4.0-rc1","104.5.0","104.5.0-beta","105.0.0","105.0.1","105.1.0","105.2.0","105.2.1","105.2.2","105.2.3","106.0.0","106.0.0-alpha0277","106.0.0-alpha0281","106.0.0-alpha0282","106.0.0-alpha0283","106.0.0-alpha0284","106.0.1","106.1.0","106.1.0-alpha0038","106.10.0","106.10.1","106.11.0","106.11.1","106.11.2","106.11.3","106.11.4","106.11.5","106.11.6","106.11.7","106.2.0","106.2.0-alpha0025","106.2.0-alpha0032","106.2.0-alpha0060","106.2.1","106.2.2","106.3.0","106.3.0-alpha0002","106.3.0-alpha0016","106.3.0-alpha0018","106.3.0-alpha0025","106.3.1","106.4.0","106.4.1","106.4.2","106.5.0","106.5.1","106.5.2","106.5.3","106.5.4","106.6.0","106.6.1","106.6.10","106.6.2","106.6.3","106.6.4","106.6.5","106.6.6","106.6.7","106.6.8","106.6.9","106.8.0","106.9.0"]}],"products":[{"vendor":"restsharp","product":"restsharp"}],"references":[{"url":"https://restsharp.dev/","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"https://github.com/restsharp/RestSharp/issues/1556","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27293","tags":["advisory"]},{"url":"https://github.com/restsharp/RestSharp/commit/be39346784b68048b230790d15333574341143bc","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9pq7-rcxv-47vq"},{"url":"https://restsharp.dev","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-27293","description":"RestSharp \u003c 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTimes. If a server responds with a malicious string, the client using RestSharp will be stuck processing it for an exceedingly long time. Thus the remote server can trigger Denial of Service.","status":"published","published":"2021-07-12T10:47:01Z","modified":"2024-08-03T20:48:16.148Z","updated_at":"2026-11-02T14:33:04.360272Z"}],"euvd":[{"id":"EUVD-2021-1455","description":"RestSharp \u003c 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTimes. If a server responds with a malicious string, the client using RestSharp will be stuck processing it for an exceedingly long time. Thus the remote server can trigger Denial of Service.","status":"published","published":"2021-07-12T10:47:01Z","modified":"2024-08-03T20:48:16Z","updated_at":"2026-11-03T03:24:49.368497Z"}],"ghsa":[{"id":"GHSA-9pq7-rcxv-47vq","title":"Incorrect Regular Expression in RestSharp","description":"RestSharp \u003c 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTimes. If a server responds with a malicious string, the client using RestSharp will be stuck processing it for an exceedingly long time. Thus the remote server can trigger Denial of Service.","status":"published","published":"2021-07-14T19:10:01Z","modified":"2023-02-01T05:06:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-185","CWE-697"],"updated_at":"2026-11-02T14:36:37.441118Z"}],"nvd":[{"id":"CVE-2021-27293","description":"RestSharp \u003c 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTimes. If a server responds with a malicious string, the client using RestSharp will be stuck processing it for an exceedingly long time. Thus the remote server can trigger Denial of Service.","status":"published","published":"2021-07-12T11:15:08.1Z","modified":"2026-06-17T03:44:37.553Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-697"],"updated_at":"2026-11-02T14:06:55.259633Z"}],"osv":[{"id":"CVE-2021-27293","description":"RestSharp \u003c 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTimes. If a server responds with a malicious string, the client using RestSharp will be stuck processing it for an exceedingly long time. Thus the remote server can trigger Denial of Service.","status":"published","published":"2021-07-12T11:15:08.1Z","modified":"2026-10-20T10:54:35.50490156Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"GHSA-9pq7-rcxv-47vq","title":"Incorrect Regular Expression in RestSharp","description":"RestSharp \u003c 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTimes. If a server responds with a malicious string, the client using RestSharp will be stuck processing it for an exceedingly long time. Thus the remote server can trigger Denial of Service.","status":"published","published":"2021-07-14T19:10:01Z","modified":"2024-02-17T05:37:00.550018Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-185","CWE-697"],"updated_at":"2026-11-02T15:46:43.875515Z"}]}}