CVE-2023-22467

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2.1, Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks. This issue also appears in Moment as CVE-2022-31129. Versions 1.38.1, 2.5.2, and 3.2.1 contain patches for this issue. As a workaround, limit the length of the input.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1333

Affected software

No affected versions have been published.

Timeline

Published: Jan 4, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-224685.4Discourse is an open source platform for community discussion. Versions prior to 2.8.13 (stable), 3.0.0.beta16 (beta) and 3.0.0beta16 (tests CVE-2023-224693.5Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. When getti CVE-2023-22475.3In affected versions of Octopus Deploy it is possible to unmask variable secrets using the variable preview function CVE-2023-224706.5Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. CVE-2023-224714.3Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Broken acc CVE-2023-224728.8Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is poss CVE-2023-224732.1Talk-Android enables users to have video & audio calls through Nextcloud on Android. Due to passcode bypass, an attacker is able to access t CVE-2023-224748.1Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header CVE-2023-224756.1Canarytokens is an open source tool which helps track activity and actions on your network. A Cross-Site Scripting vulnerability was identif CVE-2023-224764.3Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any log CVE-2023-224777.5Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sendi CVE-2023-224787.5KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been p