CVE-2023-26103

CVE-2023-26103 describes a Regular Expression Denial of Service (ReDoS) vulnerability in the Deno runtime, affecting versions prior to 1.31.0. The root cause lies in the upgradeWebSocket function within ext/http/01_http.js. This function uses a regex pattern /s*,s*/ to split the Connection and Upgrade headers [1][4]. When a specially crafted header containing many commas and whitespace characters is supplied, the regex engine can encounter catastrophic backtracking, consuming CPU resources disproportionately to the input size [1][3].

To exploit this vulnerability, an attacker must be able to send HTTP requests to a Deno server that utilizes WebSocket upgrades. No authentication is required if the server endpoint is exposed publicly. The attack involves sending a crafted Connection or Upgrade header with a carefully constructed sequence of spaces and commas, which causes the regex matching to take exponential time to process [1][3]. This is a classic ReDoS attack vector, where a seemingly simple regex can be forced into a worst-case performance scenario by malicious input.

The impact of successful exploitation is a Denial of Service condition: the affected server process becomes unresponsive or significantly slowed while processing the malicious header. An attacker can tie up server resources, making the WebSocket server unavailable for legitimate requests. There is no data breach or code execution risk, but the attack can disrupt service availability [1][3].

Mitigation is straightforward: users should upgrade Deno to version 1.31.0 or later, as released on February 23, 2023 [2]. The fix addresses the regex pattern to prevent catastrophic backtracking. No workaround is listed for unpatched versions; upgrading is the recommended action [1][2].