CVE-2021-27290

ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.

• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfPatch, Third Party Advisory
• https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdfExploit, Patch, Third Party Advisory
• https://github.com/yetingli/SaveResults/blob/main/pdf/ssri-redos.pdfExploit, Third Party Advisory
• https://npmjs.comProduct
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfPatch, Third Party Advisory
• https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdfExploit, Patch, Third Party Advisory
• https://github.com/yetingli/SaveResults/blob/main/pdf/ssri-redos.pdfExploit, Third Party Advisory
• https://npmjs.comProduct
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory

Published

Mar 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-27278This vulnerability allows local attackers to escalate privil…8.2
• CVE-2021-27279MyBB before 1.8.25 allows stored XSS via nested [email] tags…5.4
• CVE-2021-27280OS Command injection vulnerability in mblog 3.5.0 allows att…7.8
• CVE-2021-27285An issue was discovered in Inspur ClusterEngine v4.0 that al…8.4
• CVE-2021-27288Cross Site Scripting (XSS) in X2Engine X2CRM v7.1 allows rem…6.1
• CVE-2021-27289A replay attack vulnerability was discovered in a Zigbee sma…9.1
• CVE-2021-27291In pygments 1.1+, fixed in 2.7.4, the lexers used to parse p…7.5
• CVE-2021-27292ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expr…7.5
• CVE-2021-27293RestSharp < 106.11.8-alpha.0.13 uses a regular expression wh…7.5
• CVE-2021-27294Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-27306An improper access control vulnerability in the JWT plugin i…7.5
• CVE-2021-27308A cross-site scripting (XSS) vulnerability in the admin logi…4.8