{"id":"CVE-2021-32832","aliases":["EUVD-2021-19570","GHSA-wpp8-mvvg-33rx"],"status":"published","title":"ReDOS in Rocket.Chat","description":"Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript. In Rocket.Chat before versions 3.11.3, 3.12.2, and 3.13 an issue with certain regular expressions could lead potentially to Denial of Service. This was fixed in versions 3.11.3, 3.12.2, and 3.13.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0162,"percentile":0.76388,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-400"],"published":"2021-08-30T20:55:13Z","modified":"2026-10-20T10:54:43Z","products":[{"vendor":"rocket.chat","product":"rocket.chat"},{"vendor":"rocketchat","product":"rocket.chat"}],"references":[{"url":"https://docs.rocket.chat/guides/security/security-updates","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://securitylab.github.com/advisories/GHSL-2020-310-redos-Rocket.Chat/","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/RocketChat/Rocket.Chat/releases/tag/3.11.3","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory"]},{"url":"https://github.com/RocketChat/Rocket.Chat/commit/4a0dce973e37ec3f56ca2231d6030511dbdd094c","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32832"},{"url":"https://github.com/advisories/GHSA-wpp8-mvvg-33rx"}],"sources":{"cve":[{"id":"CVE-2021-32832","title":"ReDOS in Rocket.Chat","description":"Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript. In Rocket.Chat before versions 3.11.3, 3.12.2, and 3.13 an issue with certain regular expressions could lead potentially to Denial of Service. This was fixed in versions 3.11.3, 3.12.2, and 3.13.","status":"published","published":"2021-08-30T20:55:13Z","modified":"2024-08-03T23:33:55.938Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:33:07.014772Z"}],"euvd":[{"id":"EUVD-2021-19570","description":"Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript. In Rocket.Chat before versions 3.11.3, 3.12.2, and 3.13 an issue with certain regular expressions could lead potentially to Denial of Service. This was fixed in versions 3.11.3, 3.12.2, and 3.13.","status":"published","published":"2021-08-30T20:55:13Z","modified":"2024-08-03T23:33:55Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T03:24:35.30045Z"}],"ghsa":[{"id":"GHSA-wpp8-mvvg-33rx","title":"Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript....","description":"Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript. In Rocket.Chat before versions 3.11.3, 3.12.2, and 3.13 an issue with certain regular expressions could lead potentially to Denial of Service. This was fixed in versions 3.11.3, 3.12.2, and 3.13.","status":"published","published":"2022-05-24T19:12:25Z","modified":"2023-01-30T05:01:49Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:46:29.807452Z"}],"nvd":[{"id":"CVE-2021-32832","description":"Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript. In Rocket.Chat before versions 3.11.3, 3.12.2, and 3.13 an issue with certain regular expressions could lead potentially to Denial of Service. This was fixed in versions 3.11.3, 3.12.2, and 3.13.","status":"published","published":"2021-08-30T21:15:09.35Z","modified":"2026-06-17T03:53:43.32Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:06:57.67549Z"}],"osv":[{"id":"CVE-2021-32832","description":"Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript. In Rocket.Chat before versions 3.11.3, 3.12.2, and 3.13 an issue with certain regular expressions could lead potentially to Denial of Service. This was fixed in versions 3.11.3, 3.12.2, and 3.13.","status":"published","published":"2021-08-30T21:15:09.35Z","modified":"2026-10-20T10:54:43.247275542Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:19.793849Z"}]}}