Denial of service (DoS) in i18n
Priority LOW 38CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
This affects the package i18n before 2.1.15. Vulnerability arises out of insufficient handling of erroneous language tags in src/i18n/Concrete/TextLocalizer.cs and src/i18n/LocalizedApplication.cs.
Why it matters now
EPSS 0.03013 87th percentileScored 2026-11-07
Fix Fixed i18n: 2.1.15i18n (NuGet): 2.1.15
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | i18n | before 2.1.15 | 2.1.15 | Patch available | CNA |
| — | i18n (NuGet) | before 2.1.15 | 2.1.15 | Patch available | GHSA-hfvc-g252-rp4g |
- i18n Vendor— Affected before 2.1.15 Fixed in 2.1.15 Patch available CNA
- i18n (NuGet) Vendor— Affected before 2.1.15 Fixed in 2.1.15 Patch available GHSA-hfvc-g252-rp4g
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:i18n_project:i18n:*:*:*:*:*:asp.net:*:* | before 2.1.15 | Vulnerable | I18n Project |
- cpe:2.3:a:i18n_project:i18n:*:*:*:*:*:asp.net:*:* Versions before 2.1.15 Vulnerable ·I18n Project
Remediation
- Fix · CNA i18n Fixed in 2.1.15
- Fix · GHSA-hfvc-g252-rp4g i18n (NuGet) Fixed in 2.1.15 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-7791
- 2026-10-03 Alias added: GHSA-hfvc-g252-rp4g
References
Advisory 2
Other 18
- [myfaces-dev] 20210506 [GitHub] [myfaces-tobago] lofwyr14 opened a new pull request #821: build: CVE fix
- [druid-commits] 20210506 [GitHub] [druid] jihoonson commented on a change in pull request #11215: Suppressing false positive CVE-2020-7791
- [druid-commits] 20210506 [GitHub] [druid] maytasm opened a new pull request #11215: Suppressing false positive CVE-2020-7791
- [druid-commits] 20210506 [GitHub] [druid] maytasm merged pull request #11215: Suppressing false positive CVE-2020-7791
- [druid-commits] 20210506 [GitHub] [druid] maytasm commented on a change in pull request #11215: Suppressing false positive CVE-2020-7791
- [druid-commits] 20210506 [GitHub] [druid] clintropolis opened a new pull request #11217: [Backport] Suppressing false positive CVE-2020-7791
- [druid-commits] 20210507 [GitHub] [druid] clintropolis commented on pull request #11217: [Backport] Suppressing false positive CVE-2020-7791
- [druid-commits] 20210507 [GitHub] [druid] clintropolis merged pull request #11217: [Backport] Suppressing false positive CVE-2020-7791
- [druid-commits] 20210507 [druid] branch 0.21.1 updated: Suppressing false positive CVE-2020-7791 (#11215) (#11217)
- https://lists.apache.org/thread.html/r1573c58dc283b05f7a40a3f5ff0079b5bbde0492d406ee0fe98d40b6@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r2667286c8ceffaf893b16829b9612d8f7c4ee6b30362c6c1b583e3c2@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r33dc233634aedb04fa77db3eb79ea12d15ca4da89fa46a1c585ecb0b@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r394b1ae54693609a60ea8aab02ff045dc92f593aa3aebff562e69958@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r5e08837e695efd36be73510ce58ec05785dbcea077819d8acc2d990d@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r9744574911e7e4edf5f4eeae92a4ccc83e3723cec937950062bb8775@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/ra5047392edf1fecba441c9adc8807ed6c5f7d2cc71f2f3bb89f35371@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rc2abba7aa0450198494bbee654fce9b97fad72a4989323e189faede4@%3Cdev.myfaces.apache.org%3E
- https://lists.apache.org/thread.html/rc850d0fce066f9eb9e8553172d9207bad7df4d2059d93abc5c7e85c4@%3Ccommits.druid.apache.org%3E
More I18n Project I18n vulnerabilities
- TI-2014-08233 Hash#slice in lib/i18n/core_ext/hash.rb in the i18n gem before 0.8.0 for Ruby allows… CVSS 3.0HIGH 7.5
- TI-2013-03941 Cross-site scripting (XSS) vulnerability in exceptions.rb in the i18n gem before 0.6.6… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2020-7791 · CVE Program
- CVE-2020-7791 · NVD
- FIRST EPSS
- GHSA-hfvc-g252-rp4g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences