CVE-2023-25166

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1333

Affected software

No affected versions have been published.

Timeline

Published: Feb 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-251675.7Discourse is an open source discussion platform. In affected versions a malicious user can cause a regular expression denial of service usin CVE-2023-251688.2Wings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. CVE-2023-251695.3discourse-yearly-review is a discourse plugin which publishes an automated Year in Review topic. In affected versions a user present in a ye CVE-2023-25174.3The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including CVE-2023-251708.8PrestaShop is an open source e-commerce web application that, prior to version 8.0.1, is vulnerable to cross-site request forgery (CSRF). Wh CVE-2023-251715.9Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt den CVE-2023-251725.4Discourse is an open-source discussion platform. Prior to version 3.0.1 of the `stable` branch and version 3.1.0.beta2 of the `beta` and `te CVE-2023-251737.8containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups CVE-2023-251747.8Improper access control in some Intel(R) Chipset Driver Software before version 10.1.19444.8378 may allow an authenticated user to potential CVE-2023-251755.5Improper input validation in some Intel(R) Server Board BMC firmware before version 2.90 may allow a privileged user to enable information d CVE-2023-251765.5in OpenHarmony v3.2.4 and prior versions allow a local attacker cause information leak through out-of-bounds Read.CVE-2023-251777.8Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to stack-based buffer overflow, which could allow an attacke