Skip to content
OpenAdvisories
Medium · 5.3 CVE-2023-26118 EUVD-2023-1086GHSA-qwqh-hm9m-p5hr

angular vulnerable to regular expression denial of service via the <input type="url"> element

Published Mar 30, 2023 · Updated Nov 3, 2025 · Assigned by snyk

Package: angular Package: angular.js Package: angular.js Ecosystem: Debian Ecosystem: npm Ecosystem: Ubuntu

Description

Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> element due to the usage of an insecure regular expression in the input[url] functionality. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

Affected products

VendorProductAffectedFixed
— angular 1.4.9 —
— org.webjars.bower:angular 1.4.9 —
— org.webjars.npm:angular 1.4.9 —
— org.webjars.bowergithub.angular:angular — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 13 angular.js 1.8.3-2 —
Debian 12 angular.js 1.8.3-1+deb12u1 —
Debian 11 angular.js 1.8.3-1+deb12u1~deb11u1 DLA-4242-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS angular.js 1.8.3-1ubuntu0.24.04.1 —
Ubuntu 22.04 LTS angular.js 1.8.2-2ubuntu0.1 —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS angular.js 1.7.9-1ubuntu0.1~esm1 —
Ubuntu Pro 18.04 LTS angular.js 1.5.10-1ubuntu0.1~esm1 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm angular <= 1.8.3 — GHSA-qwqh-hm9m-p5hr

Advisories 3

References