CVE-2022-24713
📋 TL;DR
CVE-2022-24713 is a vulnerability in the Rust regex crate where built-in mitigations against regex-based denial of service attacks can be bypassed. This allows attackers to craft malicious regexes that cause excessive CPU consumption and service disruption. Only applications that accept user-controlled regexes as input are affected.
💻 Affected Systems
- Rust applications using regex crate
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Regex by Rust Lang
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to CPU exhaustion, potentially affecting all users of the vulnerable service.
Likely Case
Degraded performance or temporary service disruption for applications accepting user regex input.
If Mitigated
No impact if regex crate is updated or if applications don't accept user regexes.
🎯 Exploit Status
Exploitation requires sending specially crafted regex patterns to vulnerable endpoints. No authentication needed if service accepts regex input from unauthenticated users.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: regex 1.5.5 and later
Vendor Advisory: https://github.com/rust-lang/regex/security/advisories/GHSA-m5pq-gvj9-9vr8
Restart Required: Yes
Instructions:
1. Update Cargo.toml to require regex >= 1.5.5
2. Run 'cargo update regex'
3. Rebuild and redeploy application
4. Restart affected services
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict validation to reject complex regex patterns from untrusted sources
Rate limiting regex processing
allImplement timeouts or rate limits on regex parsing operations
🧯 If You Can't Patch
- Disable user-controlled regex input entirely if not required
- Implement strict WAF rules to block suspicious regex patterns at network boundary
🔍 How to Verify
Check if Vulnerable:
Check Cargo.lock or Cargo.toml for regex crate version <= 1.5.4Check Version:
grep -A 1 'name = "regex"' Cargo.lockVerify Fix Applied:
Verify regex crate version is >= 1.5.5 in Cargo.lock after update📡 Detection & Monitoring
Log Indicators:
- Unusually long regex processing times
- High CPU usage spikes from regex operations
- Repeated regex parsing failures
Network Indicators:
- Incoming requests containing complex regex patterns
- Traffic patterns showing regex submission attempts
SIEM Query:
source="application_logs" AND (message="*regex*" AND duration>5s) OR (process="rust_app" AND cpu_usage>90%)🔗 References
- https://github.com/rust-lang/regex/commit/ae70b41d4f46641dbc45c7a4f87954aea356283e
- https://github.com/rust-lang/regex/security/advisories/GHSA-m5pq-gvj9-9vr8
- https://groups.google.com/g/rustlang-security-announcements/c/NcNNL1Jq7Yw
- https://lists.debian.org/debian-lts-announce/2022/04/msg00003.html
- https://lists.debian.org/debian-lts-announce/2022/04/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JANLZ3JXWJR7FSHE57K66UIZUIJZI67T/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3YB7CURSG64CIPCDPNMGPE4UU24AB6H/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PDOWTHNVGBOP2HN27PUFIGRYNSNDTYRJ/
- https://security.gentoo.org/glsa/202208-08
- https://security.gentoo.org/glsa/202208-14
- https://www.debian.org/security/2022/dsa-5113
- https://www.debian.org/security/2022/dsa-5118
- https://github.com/rust-lang/regex/commit/ae70b41d4f46641dbc45c7a4f87954aea356283e
- https://github.com/rust-lang/regex/security/advisories/GHSA-m5pq-gvj9-9vr8
- https://groups.google.com/g/rustlang-security-announcements/c/NcNNL1Jq7Yw
- https://lists.debian.org/debian-lts-announce/2022/04/msg00003.html
- https://lists.debian.org/debian-lts-announce/2022/04/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JANLZ3JXWJR7FSHE57K66UIZUIJZI67T/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3YB7CURSG64CIPCDPNMGPE4UU24AB6H/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PDOWTHNVGBOP2HN27PUFIGRYNSNDTYRJ/
- https://security.gentoo.org/glsa/202208-08
- https://security.gentoo.org/glsa/202208-14
- https://www.debian.org/security/2022/dsa-5113
- https://www.debian.org/security/2022/dsa-5118
