CVE-2018-11615 Mosca REDoS Vulnerability

HighCVSS 7.5 EPSS 3.2%

Published: 2018-08-30 15:00
Updated: 2026-06-17 04:36
Exploit status: No public exploit known

Description

This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of topics. A crafted regular expression can cause the broker to crash. An attacker can leverage this vulnerability to deny access to the target system. Was ZDI-CAN-6306.

Affected products

Product	Affected versions	Fixed in
npm mosca(npm)	< 2.8.2	2.8.2
mosca project mosca	= 2.8.1	No fix listed
npm mosca	= 2.8.1	No fix listed

References

nvd.nist.gov third-party-advisory
github.com
zerodayinitiative.com third-party-advisory vdb-entry

CVSS v3.0

7.5 High

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

All scores (3)

v3.0 7.5 · nvd@nist.gov
v3.0 7.5 · github
v2.0 7.8 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 3.22% (percentile 88.4)
CWE: CWE-185 Incorrect Regular Expression CWE-20 Improper Input Validation

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.