Denial of Service of regular expression in package @adobe/css-tools
Priority LOW 35CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 5 fixed, 8 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
@adobe/css-tools versions 4.3.1 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS.
Why it matters now
EPSS 0.01111 66th percentileScored 2026-11-07
Fix Partial @adobe/css-tools (npm): 4.3.2Red Hat: 4 advisoriesRed Hat: 5 fixed, 8 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Adobe | Not a product | up to 4.3.1 | — | No fix listed | CNA |
| — | @adobe/css-tools (npm) | before 4.3.2 | 4.3.2 | Patch available | GHSA-prr3-c3m5-p7q2 |
- Not a product VendorAdobe Affected up to 4.3.1 Fixed in — No fix listed CNA
- @adobe/css-tools (npm) Vendor— Affected before 4.3.2 Fixed in 4.3.2 Patch available GHSA-prr3-c3m5-p7q2
Remediation
- Fix · GHSA-prr3-c3m5-p7q2 @adobe/css-tools (npm) Fixed in 4.3.2 Advisory →
Red Hat 4 advisories
- RHSA-2024:3989 Released 2024-06-20 · Red Hat rating ImportantMigration Toolkit for Applications security and bug fix update
- MTA 6.2 for RHEL 8 mta/mta-ui-rhel9, mta/mta-windup-addon-rhel9
- RHSA-2024:3919 Released 2024-06-13 · Red Hat rating ImportantMigration Toolkit for Runtimes security, bug fix and enhancement update
- Migration Toolkit for Runtimes 1 on RHEL 8 mtr/mtr-operator-bundle, mtr/mtr-rhel8-operator, mtr/mtr-web-container-rhel8 +1
- RHSA-2024:3316 Released 2024-05-23 · Red Hat rating ImportantMigration Toolkit for Applications security and bug fix update
- MTA 7.0 for RHEL 9 mta/mta-analyzer-addon-rhel9, mta/mta-analyzer-lsp-rhel9, mta/mta-cli-rhel9 +3
Show 1 more Red Hat advisories
- RHSA-2024:1383 Released 2024-03-19 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.15.0 security, enhancement, & bug fix update
- RHODF 4.15 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-operator-bundle +23
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Applications 6 | Affected | No fix planned: Will not fix |
| Migration Toolkit for Virtualization | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Virtualization 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet |
| MTA 6.2 for RHEL 8 | Fixed | RHSA-2024:3989 |
| MTA 7.0 for RHEL 9 | Fixed | RHSA-2024:3316 |
| Migration Toolkit for Runtimes 1 on RHEL 8 | Fixed | RHSA-2024:3919 |
| RHDH 1.1 for RHEL 9 | Fixed | — |
| RHODF 4.15 for RHEL 9 | Fixed | RHSA-2024:1383 |
Not affected: 10 products
- Cryostat 2
- MTA 6.2 for RHEL 8
- MTA 7.0 for RHEL 8
- MTA 7.0 for RHEL 9
- RHDH 1.1 for RHEL 9
- RHODF 4.15 for RHEL 9
- Red Hat Build of Keycloak
- Red Hat Data Grid 8
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat build of OptaPlanner 8
Timeline
- 2026-10-02 Threatist record created from CVE-2023-48631
- 2026-10-03 Alias added: GHSA-prr3-c3m5-p7q2
References
Advisory 2
More Adobe Css-tools vulnerabilities
- TI-2023-11514 Denial of Service of regular expression in package @adobe/css-tools CVSS 3.1MEDIUM 5.3
Sources
- CVE-2023-48631 · CVE Program
- CVE-2023-48631 · NVD
- FIRST EPSS
- GHSA-prr3-c3m5-p7q2 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-48631 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences