CVE-2023-26117

Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.

• CWE-1333
• CWE-1333
• CWE-1333

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQWJLE5WE33WNMA54XSJIDXBRK2KL3XJ/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UDKFLKJ6VZKL52AFVW2OVZRMJWHMW55K/
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-5406323Exploit, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-5406325Exploit, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-5406324Exploit, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JS-ANGULAR-3373045Exploit, Third Party Advisory
• https://stackblitz.com/edit/angularjs-vulnerability-resource-trailing-slashes-redosExploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2025/07/msg00005.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQWJLE5WE33WNMA54XSJIDXBRK2KL3XJ/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UDKFLKJ6VZKL52AFVW2OVZRMJWHMW55K/
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-5406323Exploit, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-5406325Exploit, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-5406324Exploit, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JS-ANGULAR-3373045Exploit, Third Party Advisory
• https://stackblitz.com/edit/angularjs-vulnerability-resource-trailing-slashes-redosExploit, Third Party Advisory

Published

Mar 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26111All versions of the package @nubosoftware/node-static; all v…7.5
• CVE-2023-26112All versions of the package configobj are vulnerable to Regu…5.9
• CVE-2023-26113Versions of the package collection.js before 6.8.1 are vulne…7.5
• CVE-2023-26114Versions of the package code-server before 4.10.1 are vulner…9.3
• CVE-2023-26115All versions of the package word-wrap are vulnerable to Regu…7.5
• CVE-2023-26116Versions of the package angular from 1.2.21 are vulnerable t…5.3
• CVE-2023-26118Versions of the package angular from 1.4.9 are vulnerable to…5.3
• CVE-2023-26119Versions of the package net.sourceforge.htmlunit:htmlunit fr…9.8
• CVE-2023-2612Jean-Baptiste Cayrou discovered that the shiftfs file system…4.7
• CVE-2023-26120This affects all versions of the package com.xuxueli:xxl-job…6.1
• CVE-2023-26121All versions of the package safe-eval are vulnerable to Prot…10
• CVE-2023-26122All versions of the package safe-eval are vulnerable to Sand…10