CVE-2023-22467

Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2.1, Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks. This issue also appears in Moment as CVE-2022-31129. Versions 1.38.1, 2.5.2, and 3.2.1 contain patches for this issue. As a workaround, limit the length of the input.

• CWE-1333

• https://github.com/moment/luxon/commit/5ab3bf64a10da929a437629cdb2f059bb83212bfPatch, Third Party Advisory
• https://github.com/moment/luxon/security/advisories/GHSA-3xq5-wjfh-ppjcThird Party Advisory
• https://github.com/moment/moment/pull/6015#issuecomment-1152961973Patch, Third Party Advisory
• https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9gNot Applicable, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/44I3WAJKYXDLOVYRGMHAUXMIV4SPFXDZ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4LIVOASKBQH7FEUI5RWM3SOHR6VK7ZZR/
• https://github.com/moment/luxon/commit/5ab3bf64a10da929a437629cdb2f059bb83212bfPatch, Third Party Advisory
• https://github.com/moment/luxon/security/advisories/GHSA-3xq5-wjfh-ppjcThird Party Advisory
• https://github.com/moment/moment/pull/6015#issuecomment-1152961973Patch, Third Party Advisory
• https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9gNot Applicable, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/44I3WAJKYXDLOVYRGMHAUXMIV4SPFXDZ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4LIVOASKBQH7FEUI5RWM3SOHR6VK7ZZR/

Published

Jan 4, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22461The `sanitize-svg` package, a small SVG sanitizer to prevent…6.1
• CVE-2023-22462Grafana is an open-source platform for monitoring and observ…5.4
• CVE-2023-22463KubePi is a k8s panel. The jwt authentication function of Ku…9.8
• CVE-2023-22464ViewVC is a browser interface for CVS and Subversion version…5.4
• CVE-2023-22465Http4s is a Scala interface for HTTP services. Starting with…5.3
• CVE-2023-22466Tokio is a runtime for writing applications with Rust. Start…5.4
• CVE-2023-22468Discourse is an open source platform for community discussio…5.4
• CVE-2023-22469Deck is a kanban style organization tool aimed at personal p…3.5
• CVE-2023-2247In affected versions of Octopus Deploy it is possible to unm…5.3
• CVE-2023-22470Nextcloud Deck is a kanban style organization tool aimed at …6.5
• CVE-2023-22471Deck is a kanban style organization tool aimed at personal p…4.3
• CVE-2023-22472Deck is a kanban style organization tool aimed at personal p…8.8