PT-2022-20550 · Moment+5 · Moment+6
Hernev
+1
·
Published
2022-07-06
·
Updated
2026-06-04
·
CVE-2022-31129
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
moment versions prior to 2.29.4
Description
The issue is related to an inefficient parsing algorithm used in the moment JavaScript date library, specifically in the string-to-date parsing and rfc2822 parsing. This results in quadratic complexity on specific inputs, causing a noticeable slowdown with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to the moment constructor are vulnerable to (Re)DoS attacks.
Recommendations
For moment versions prior to 2.29.4, upgrade to version 2.29.4 or later.
As a temporary workaround, consider limiting the length of user input to something sane, like 200 characters or less, to minimize the risk of exploitation.
Exploit
Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Bitbucket
Confluence
Linuxmint
Suse
Ubuntu
Moment