VYPR
← All advisories
High severityNVD Advisory· Published Sep 20, 2021· Updated Aug 4, 2024

Regular expression deinal of service in apprise

CVE-2021-39229

Description

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. In affected versions users who use Apprise granting them access to the IFTTT plugin (which just comes out of the box) are subject to a denial of service attack on an inefficient regular expression. The vulnerable regular expression is here. The problem has been patched in release version 0.9.5.1. Users who are unable to upgrade are advised to remove apprise/plugins/NotifyIFTTT.py to eliminate the service.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
apprisePyPI
< 0.9.5.10.9.5.1

Affected products

1

Patches

1
e20fce630d55

Slight bulletproofing to IFTTT regex handling (#436)

https://github.com/caronc/appriseChris CaronSep 6, 2021via ghsa
commit
1 file changed · +1 −1
  • apprise/plugins/NotifyIFTTT.py+1 −1 modified
    @@ -355,7 +355,7 @@ def parse_native_url(url):
         result = re.match(
             r'^https?://maker\.ifttt\.com/use/'
             r'(?P<webhook_id>[A-Z0-9_-]+)'
-            r'/?(?P<events>([A-Z0-9_-]+/?)+)?'
+            r'((?P<events>(/[A-Z0-9_-]+)+))?'
             r'/?(?P<params>\?.+)?$', url, re.I)
 
         if result:

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.