CVE-2020-6817: Regular Expression Denial-of-Service in Bleach
Summary
CVE-2020-6817: regular expression denial-of-service (ReDoS) in Bleach. Affects bleach versions < 3.1.4. Fixed in 3.1.4. How to fix ↓
Also tracked for
- python-bleach · Debian:11
The same CVE-2020-6817 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bleach is an open-source Python library that sanitizes and cleans HTML input. It is commonly used to prevent cross-site scripting (XSS) attacks by removing potentially harmful tags and attributes from user-generated content. Bleach provides a clean function that allows developers to specify which tags and attributes are allowed in the sanitized output. However, a vulnerability has been discovered in the bleach.clean function that can lead to a regular expression denial-of-service (ReDoS) attack.
Vulnerability Detail
The bleach.clean function in Bleach is vulnerable to ReDoS attacks when called with an allowed tag and an allowed style attribute. This vulnerability arises from the way style attributes are parsed, allowing an attacker to craft a malicious input that triggers a ReDoS. A ReDoS attack can cause the function to consume excessive amounts of CPU time, leading to a denial-of-service condition. This can impact the availability of the application and potentially disrupt its normal operation.
How To Fix
Latest published version: 6.4.0 as of 22 Oct 2026
pip install --upgrade "bleach==6.4.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.4
This is the first release that contains the fix.
pip install --upgrade "bleach==3.1.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version of Bleach is not immediately feasible, there are a couple of workarounds that can mitigate the risk of this vulnerability. One option is to avoid whitelisting the style attribute in bleach.clean calls. By not allowing the style attribute, the ReDoS vulnerability can be bypassed. Another workaround is to limit the length of the input string, as ReDoS attacks typically require a large input to be effective.
Conclusion
The vulnerability in Bleach allows for a ReDoS attack when using the bleach.clean function with an allowed tag and an allowed style attribute. To mitigate this vulnerability, it is recommended to update to Bleach version 3.1.4 or later. If immediate updating is not possible, workarounds such as avoiding whitelisting the style attribute and limiting input string length can be implemented. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for bleach →
FAQ
Bleach is a Python library used for sanitizing and cleaning HTML input to prevent cross-site scripting (XSS) attacks.
A ReDoS attack is a type of denial-of-service attack that exploits the way regular expressions are processed. By providing a specially crafted input, an attacker can cause the regular expression matching algorithm to take an excessive amount of time, leading to a denial-of-service condition.
The ReDoS vulnerability in Bleach can be exploited by an attacker to cause the bleach.clean function to consume excessive CPU time, leading to a denial-of-service condition. This can impact the availability of the application and potentially disrupt its normal operation.
To fix the vulnerability, update the Bleach library to version 3.1.4 or later. This version includes a patch that addresses the ReDoS vulnerability. Make sure to use the updated version in your application.
Yes, if updating to the latest version of Bleach is not immediately feasible, you can avoid whitelisting the style attribute in bleach.clean calls. Additionally, limiting the length of the input string can also mitigate the risk of a ReDoS attack.
Related vulnerabilities
Recent vulnerabilities recorded for bleach.
