CVE-2020-6817: Mozilla Bleach Regular Expression Denial of Service (ReDoS)
Summary
CVE-2020-6817: In Mozilla Bleach before 3.1.4, bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Affects bleach versions < 3.1.4. Fixed in 3.1.4. How to fix ↓
Also tracked for
- python-bleach · Debian:11
The same CVE-2020-6817 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Bleach is a Python library that sanitizes and cleans HTML input to prevent cross-site scripting (XSS) attacks. It provides a set of functions to remove potentially dangerous HTML tags and attributes. Bleach is commonly used in web applications to sanitize user-generated content before displaying it on web pages.
Vulnerability Detail
The vulnerability (CVE-2020-6817) exists in Mozilla Bleach versions before 3.1.4. The bleach.clean function, responsible for parsing and cleaning HTML, is susceptible to a regular expression denial of service (ReDoS) attack. An attacker can craft malicious input that triggers a ReDoS, causing the function to consume excessive CPU resources and potentially leading to a denial of service condition. This vulnerability can be exploited by an attacker with the ability to provide input that is processed by the bleach.clean function.
How To Fix
Latest published version: 6.4.0 as of 22 Oct 2026
pip install --upgrade "bleach==6.4.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.4
This is the first release that contains the fix.
pip install --upgrade "bleach==3.1.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of Mozilla Bleach as soon as possible.
Conclusion
The vulnerability (CVE-2020-6817) in Mozilla Bleach allows for a regular expression denial of service (ReDoS) attack. Upgrading to version 3.1.4 or later is recommended to mitigate the risk. There is no known workaround for this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bleach →
FAQ
Mozilla Bleach is a Python library used for sanitizing and cleaning HTML input to prevent cross-site scripting (XSS) attacks.
A regular expression denial of service (ReDoS) attack is a type of denial of service attack that exploits the exponential time complexity of certain regular expressions. By providing specially crafted input, an attacker can cause the regular expression matching algorithm to take an excessive amount of time, leading to a denial of service condition.
This vulnerability can be exploited by an attacker to cause a denial of service condition in applications that use Mozilla Bleach. The excessive CPU usage caused by the ReDoS attack can lead to degraded performance or unresponsiveness of the affected application.
No, only versions before 3.1.4 are affected by this vulnerability. It is recommended to upgrade to the latest version to mitigate the risk.
Yes, the vulnerability has been fixed in Mozilla Bleach version 3.1.4. Users should upgrade to this version or later to address the issue.
Related vulnerabilities
Recent vulnerabilities recorded for bleach.
