ReDOS Vulnerability in Mpmath Package: Denial of Service Risk
Summary
CVE-2021-29063: A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 through v1.2.1 when the mpmathify function is called. Affects mpmath across 3 version ranges.
>= 8e21a638727567914536f4a4a63aa5fa204c40f0, <= c6a35f9ee7c294bcf4e0517bc76b268843db9499
< 46d44c3c8f3244017fe1eb102d564eb4ab8ef750
< b5c04506ef0cd4a1f1213f8389ee21c9c3551582
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mpmath is a Python library for arbitrary-precision arithmetic, allowing users to perform complex mathematical calculations with high precision. It is widely used in scientific computing and mathematical research. The library's functionality includes support for real and complex numbers, as well as various mathematical functions. However, versions 1.0.0 through 1.2.1 of Mpmath are susceptible to a Regular Expression Denial of Service (ReDOS) vulnerability, which can be exploited under specific conditions.
Vulnerability Detail
The vulnerability arises from the mpmathify function in Mpmath, which utilizes regular expressions that can be exploited to cause excessive backtracking. This can lead to a denial of service, as the function may consume significant CPU resources when processing specially crafted input. The impact of this vulnerability is particularly concerning in environments where Mpmath is used for real-time calculations, as it could lead to application unresponsiveness or crashes. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing input validation to sanitize user inputs before passing them to the mpmathify function. This can help mitigate the risk of exploitation by ensuring that only safe inputs are processed.
Conclusion
The ReDOS vulnerability in the Mpmath package poses a significant risk, particularly in environments that rely on real-time calculations. Users are strongly encouraged to upgrade to the latest version to mitigate this risk. Implementing input validation can serve as a temporary measure until an upgrade is feasible.
See every vulnerability recorded for mpmath →
FAQ
ReDOS is a type of denial of service attack that exploits the backtracking behavior of regular expressions, causing excessive resource consumption and potentially crashing the application.
Mpmath versions 1.0.0 through 1.2.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Implement input validation to sanitize inputs before they reach the mpmathify function as a temporary workaround.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for mpmath.
