CVE-2023-26118

Vulnerability

CVE-2023-26118 is a Regular Expression Denial of Service (ReDoS) vulnerability in AngularJS (package angular) affecting versions from 1.4.9 onward. The flaw resides in the input[url] directive, which uses an insecure regular expression to validate URL inputs. When processing a large, carefully-crafted input, the regex engine can enter catastrophic backtracking, consuming excessive CPU time [1][4].

Exploitation

An attacker can exploit this vulnerability by submitting a specially constructed, lengthy URL string to any form field bound to `` in an AngularJS application. No authentication is required if the application allows unauthenticated users to submit such input. The attack is performed entirely via normal HTTP requests, requiring no special network position [1][3].

Impact

Successful exploitation causes the application to become unresponsive due to high CPU consumption, effectively resulting in a denial of service (DoS) for legitimate users. The attack does not lead to data exfiltration or code execution, but it can severely degrade or halt service availability [3][4].

Mitigation

AngularJS reached end of life in January 2022 and no patches will be issued [2]. Users are strongly advised to migrate to the actively supported Angular framework (angular.io). For those who cannot migrate, input throttling or alternative URL validation mechanisms may reduce risk, but the underlying vulnerable code remains. Debian has released a notification for their LTS distribution [1], indicating that the vulnerability is widely recognized.