CVE-2021-32832

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript. In Rocket.Chat before versions 3.11.3, 3.12.2, and 3.13 an issue with certain regular expressions could lead potentially to Denial of Service. This was fixed in versions 3.11.3, 3.12.2, and 3.13.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
RocketChat	Rocket.Chat	< 3.11.3

References

https://docs.rocket.chat/guides/security/security-updatesVendor Advisory
https://github.com/RocketChat/Rocket.Chat/commit/4a0dce973e37ec3f56ca2231d6030511dbdd094cPatch, Third Party Advisory
https://github.com/RocketChat/Rocket.Chat/releases/tag/3.11.3Release Notes, Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2020-310-redos-Rocket.Chat/Exploit, Third Party Advisory
https://docs.rocket.chat/guides/security/security-updatesVendor Advisory
https://github.com/RocketChat/Rocket.Chat/commit/4a0dce973e37ec3f56ca2231d6030511dbdd094cPatch, Third Party Advisory
https://github.com/RocketChat/Rocket.Chat/releases/tag/3.11.3Release Notes, Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2020-310-redos-Rocket.Chat/Exploit, Third Party Advisory

Timeline

Published: Aug 30, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-328338.6Emby Server is a personal media server with apps on many devices. In Emby Server on Windows there is a set of arbitrary file read vulnerabil CVE-2021-328349.9Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a user able to crea CVE-2021-328359.9Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a sandbox escape vu CVE-2021-328368.1ZStack is open source IaaS(infrastructure as a service) software. In ZStack before versions 3.10.12 and 4.1.6 there is a pre-auth unsafe des CVE-2021-328377.5mechanize, a library for automatically interacting with HTTP web servers, contains a regular expression that is vulnerable to regular expres CVE-2021-328387.5Flask-RESTX (pypi package flask-restx) is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS CVE-2021-328397.5sqlparse is a non-validating SQL parser module for Python. In sqlparse versions 0.4.0 and 0.4.1 there is a regular Expression Denial of Serv CVE-2021-328409.8SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry `../evil.txt` may be extracted in t CVE-2021-328415.3SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.3.0 and prior to version 1.3.3, a check was added if the CVE-2021-328425.3SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.0.0 and prior to version 1.3.3, a check was added if the CVE-2021-328435.5HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, `virtio.c` has CVE-2021-328445.5HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, ` vi_pci_write`