CVE-2021-44686

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in html_preprocess_rules in ebooks/conversion/preprocess.py.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugs.launchpad.net/calibre/+bug/1951979Exploit, Issue Tracking, Vendor Advisory
https://github.com/dwisiswant0/advisory/issues/18Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/kovidgoyal/calibre/compare/v5.31.1...v5.32.0Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W7QKFPYJ23KG6WJ5NIYAM4N2NWZCLQGL/
https://bugs.launchpad.net/calibre/+bug/1951979Exploit, Issue Tracking, Vendor Advisory
https://github.com/dwisiswant0/advisory/issues/18Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/kovidgoyal/calibre/compare/v5.31.1...v5.32.0Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/09/msg00005.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W7QKFPYJ23KG6WJ5NIYAM4N2NWZCLQGL/

Timeline

Published: Dec 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-44698.7Denver SHO-110 IP cameras expose a secondary HTTP service on TCP port 8001 that provides access to a '/snapshot' endpoint without authentica CVE-2021-446925.3BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a CVE-2021-446934.9Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deni CVE-2021-446945.5Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deni CVE-2021-446954.9Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a deni CVE-2021-446965.5Adobe Prelude version 22.1.1 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive mem CVE-2021-446973.3Adobe Audition versions 14.4 (and earlier), and 22.0 (and earlier)are affected by an out-of-bounds read vulnerability that could lead to dis CVE-2021-446983.3Adobe Audition versions 14.4 (and earlier), and 22.0 (and earlier)are affected by an out-of-bounds read vulnerability that could lead to dis CVE-2021-446993.3Adobe Audition versions 14.4 (and earlier), and 22.0 (and earlier)are affected by an out-of-bounds read vulnerability that could lead to dis CVE-2021-44709.3TG8 Firewall contains a pre-authentication remote code execution vulnerability in the runphpcmd.php endpoint. The syscmd POST parameter is p CVE-2021-447005.5Adobe Illustrator versions 25.4.2 (and earlier) and 26.0.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead CVE-2021-447017.8Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-