Denial of Service of regular expression in package @adobe/css-tools
Priority MEDIUM 63CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 7 fixed, 5 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
@adobe/css-tools version 4.3.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a minor denial of service while attempting to parse CSS. Exploitation of this issue does not require user interaction or privileges.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01154 67th percentileScored 2026-11-07
Fix Partial @adobe/css-tools (npm): 4.3.1Red Hat: 7 advisoriesRed Hat: 7 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Adobe | Not a product | up to 4.3.0 | — | No fix listed | CNA |
| — | @adobe/css-tools (npm) | before 4.3.1 | 4.3.1 | Patch available | GHSA-hpx4-r86g-5jrg |
- Not a product VendorAdobe Affected up to 4.3.0 Fixed in — No fix listed CNA
- @adobe/css-tools (npm) Vendor— Affected before 4.3.1 Fixed in 4.3.1 Patch available GHSA-hpx4-r86g-5jrg
Remediation
- Fix · GHSA-hpx4-r86g-5jrg @adobe/css-tools (npm) Fixed in 4.3.1 Advisory →
Red Hat 7 advisories
- RHSA-2025:0323 Released 2025-01-15 · Red Hat rating ModerateRed Hat OpenShift Data Foundation 4.14.13 Bug Fix Update
- RHODF 4.14 for RHEL 9 odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9, odf4/odf-multicluster-console-rhel9
- RHSA-2025:0164 Released 2025-01-09 · Red Hat rating ModerateRed Hat OpenShift Data Foundation 4.15.9 Bug Fix Update
- RHODF 4.15 for RHEL 9 odf4/mcg-core-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +1
- RHSA-2025:0082 Released 2025-01-08 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.16.5 Bug Fix Update
- RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +1
Show 4 more Red Hat advisories
- RHSA-2024:8676 Released 2024-10-30 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.17.0 Security, Enhancement, & Bug Fix Update
- RHODF 4.17 for RHEL 9 odf4/mcg-core-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +3
- RHSA-2024:3989 Released 2024-06-20 · Red Hat rating ImportantMigration Toolkit for Applications security and bug fix update
- MTA 6.2 for RHEL 8 mta/mta-ui-rhel9, mta/mta-windup-addon-rhel9
- RHSA-2024:3919 Released 2024-06-13 · Red Hat rating ImportantMigration Toolkit for Runtimes security, bug fix and enhancement update
- Migration Toolkit for Runtimes 1 on RHEL 8 mtr/mtr-operator-bundle, mtr/mtr-rhel8-operator, mtr/mtr-web-container-rhel8 +1
- RHSA-2024:3316 Released 2024-05-23 · Red Hat rating ImportantMigration Toolkit for Applications security and bug fix update
- MTA 7.0 for RHEL 9 mta/mta-analyzer-addon-rhel9, mta/mta-analyzer-lsp-rhel9, mta/mta-cli-rhel9 +3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Applications 6 | Affected | No fix planned: Will not fix |
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix planned: Will not fix |
| Red Hat build of OptaPlanner 8 | Affected | No fix planned: Will not fix |
| MTA 6.2 for RHEL 8 | Fixed | RHSA-2024:3989 |
| MTA 7.0 for RHEL 9 | Fixed | RHSA-2024:3316 |
| Migration Toolkit for Runtimes 1 on RHEL 8 | Fixed | RHSA-2024:3919 |
| RHODF 4.14 for RHEL 9 | Fixed | RHSA-2025:0323 |
| RHODF 4.15 for RHEL 9 | Fixed | RHSA-2025:0164 |
| RHODF 4.16 for RHEL 9 | Fixed | RHSA-2025:0082 |
| RHODF 4.17 for RHEL 9 | Fixed | RHSA-2024:8676 |
Not affected: 16 products
- Cryostat 2
- MTA 6.2 for RHEL 8
- MTA 7.0 for RHEL 8
- MTA 7.0 for RHEL 9
- Migration Toolkit for Virtualization
- RHODF 4.14 for RHEL 9
- RHODF 4.15 for RHEL 9
- RHODF 4.16 for RHEL 9
- RHODF 4.17 for RHEL 9
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Ansible Automation Platform 2
- Red Hat Data Grid 8
- Red Hat Developer Hub 1
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat OpenShift Container Platform 4
- Red Hat Openshift Data Foundation 4
Timeline
- 2026-10-02 Threatist record created from CVE-2023-26364
- 2026-10-03 Alias added: GHSA-hpx4-r86g-5jrg
- 2026-10-27 Affected versions changed · Red Hat
References
More Adobe Css-tools vulnerabilities
- TI-2023-26480 Denial of Service of regular expression in package @adobe/css-tools CVSS 3.1HIGH 7.5
Sources
- CVE-2023-26364 · CVE Program
- CVE-2023-26364 · NVD
- FIRST EPSS
- GHSA-hpx4-r86g-5jrg · GitHub Advisory Database · CC BY 4.0
- CVE-2023-26364 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences