Skip to content
OpenAdvisories
Medium · 4.3 CVE-2025-4690 EUVD-2025-25177GHSA-hfff-63hg-f47j

AngularJS 'linky' filter ReDoS

Published Aug 19, 2025 · Updated Aug 19, 2025 · Assigned by HeroDevs

Description

A regular expression used by AngularJS'  linky https://docs.angularjs.org/api/ngSanitize/filter/linky  filter to detect URLs in input text is vulnerable to super-linear runtime due to backtracking. With a large carefully-crafted input, this can cause a

Regular expression Denial of Service (ReDoS) https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS  attack on the application.

This issue affects all versions of AngularJS.

Note:
The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status .

Affected products

VendorProductAffectedFixed
Google AngularJS >=0.0.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 13 angular.js No fix yet —
Debian 12 angular.js No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 angular.js No fix yet —
Ubuntu 26.04 LTS angular.js No fix yet —
Ubuntu 25.10 angular.js No fix yet —
Ubuntu 24.04 LTS angular.js No fix yet —
Ubuntu 22.04 LTS angular.js No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS angular.js No fix yet —
Ubuntu Pro 18.04 LTS angular.js No fix yet —
Ubuntu Pro 16.04 LTS angular.js No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling solr-10 +1 No fix yet —

References