PT-2022-24021 · Webpack+2 · Loader-Utils+2

Kundarsowjanya · Published 2022-10-11 · Updated 2025-12-11 · CVE-2022-37599

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions webpack loader-utils version 2.0.0

Description A Regular expression denial of service (ReDoS) flaw was found in the interpolateName function in interpolateName.js via the resourcePath variable. This issue could be exploited by sending crafted requests with badly or maliciously formed strings, causing a system to crash or take a disproportional amount of time to process.

Recommendations For version 2.0.0, update to version 2.0.4 to resolve the issue. As a temporary workaround, consider restricting the use of the interpolateName function until a patch is available. Avoid using the resourcePath variable in the affected interpolateName.js file until the issue is resolved.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-1333

Related Identifiers

CVE-2022-37599

GHSA-HHQ3-FF78-JV3G

MGASA-2025-0194

Affected Products

Confluence

Red Os

Loader-Utils

References · 31

• https://github.com/webpack/loader-utils/issues/216 · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-37599 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0194 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37599 · Security Note
• https://osv.dev/vulnerability/GHSA-hhq3-ff78-jv3g · Vendor Advisory
• https://advisories.mageia.org/MGASA-2025-0194.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37599 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-37599 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-37599 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/VEDIJM7VQF4Q2L2KKQ6KJ2WZNR7AXYQD · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/2UGLXZO6VIHGIITQTEUY5Q5YCAP2A4ZP · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-37599 · Security Note