High severityNVD Advisory· Published Jun 21, 2023· Updated Mar 8, 2025

CVE-2023-33289

Description

The urlnorm crate through 0.1.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to lib.rs. NOTE: the Supplier disputes this, taking the position that "Slow printing of URLs is not a CVE."

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
urlnormcrates.io	<= 0.1.4	—

Affected products

urlnorm/urlnormdescription
ghsa-coords
pkg:cargo/urlnorm
Range: <= 0.1.4

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-fqhp-rhm6-8rrjghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-33289ghsaADVISORY
gist.github.com/6en6ar/b118888dc739e8979038f24c8ac33611ghsaWEB
lib.rs/crates/urlnormghsaWEB
news.ycombinator.com/itemghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000