TI-2021-12513 Aliases CVE-2021-32848 GHSA-q567-jfmr-4rr7

Octobox ReDoS vulnerability

HIGH 72CWE-770Published 2023-02-20 · Updated 2025-03-10

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

Octobox is software for managing GitHub notifications. Prior to pull request (PR) 2807, a user of the system can provide a specifically crafted search query string that will trigger a ReDoS vulnerability. This issue is fixed in PR 2807.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0104 64th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Fixed octobox (octobox): 2807

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
octobox	octobox	2807 to before 2807	2807	Patch available	CNA

octobox Vendoroctobox Affected 2807 to before 2807 Fixed in 2807 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:octobox_project:octobox::::::::	before 2021-11-02	Vulnerable	Octobox Project

cpe:2.3:a:octobox_project:octobox:*:*:*:*:*:*:*:* Versions before 2021-11-02 Vulnerable ·Octobox Project

Remediation

Fix · CNA octobox (octobox) Fixed in 2807

Timeline

2026-10-02 Threatist record created from CVE-2021-32848
2026-10-03 Alias added: GHSA-q567-jfmr-4rr7

References

Exploit 2

Patch 1

https://github.com/octobox/octobox/pull/2807

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences