CVE-2020-28493: Regular Expression Denial of Service (ReDoS) in Jinja2
Summary
CVE-2020-28493: Regular Expression Denial of Service (ReDoS) in Jinja2. Affects jinja2 versions < 2.11.3. Fixed in 2.11.3. How to fix ↓
Also tracked for
- py3-jinja2 · Alpine:v3.14
The same CVE-2020-28493 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jinja2 is a popular templating engine for Python. It provides a way to generate dynamic content by combining templates with data. Jinja2 is widely used in web development frameworks and other applications that require dynamic content generation. However, versions prior to 2.11.3 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack.
Vulnerability Detail
The ReDoS vulnerability in Jinja2 is caused by a specific sub-pattern in the regex used by the urlize filter. The vulnerable sub-pattern is [a-zA-Z0-9.-]+.[a-zA-Z0-9.-]+. This pattern can be exploited by an attacker to cause a denial of service by providing a specially crafted input that triggers excessive backtracking in the regex engine. This can lead to high CPU usage and potentially crash the application. The vulnerability has a CVSS score of 5.3, indicating a moderate severity.
How To Fix
Latest published version: 3.1.6 as of 23 Oct 2026
pip install --upgrade "jinja2==3.1.6"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.11.3
This is the first release that contains the fix.
pip install --upgrade "jinja2==2.11.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Jinja2 is not immediately possible, you can mitigate the risk by avoiding the use of the urlize filter in your templates. Instead, consider using Markdown to format user content. Additionally, implementing request timeouts and limiting process memory can help mitigate the impact of a potential attack.
Conclusion
The Jinja2 package prior to version 2.11.3 is vulnerable to a ReDoS attack. To protect your application, it is recommended to upgrade to the latest version of Jinja2. If upgrading is not immediately possible, follow the provided workarounds and mitigation steps. For further assistance and support in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for jinja2 →
FAQ
Jinja2 is a templating engine for Python that allows you to generate dynamic content by combining templates with data.
A ReDoS attack is a type of denial of service attack that exploits the backtracking behavior of certain regular expressions. By providing a specially crafted input, an attacker can cause the regex engine to spend an excessive amount of time in backtracking, leading to high CPU usage and potential application crashes.
The Jinja2 ReDoS vulnerability can be exploited by an attacker to cause a denial of service by triggering excessive backtracking in the regex engine. This can result in high CPU usage and potentially crash the application.
To fix the vulnerability, upgrade to Jinja2 version 2.11.3 or later. Alternatively, you can avoid using the urlize filter in your templates and consider using Markdown instead. Implementing request timeouts and limiting process memory can also help mitigate the impact of a potential attack.
If upgrading to the latest version of Jinja2 is not immediately possible, you can mitigate the risk by avoiding the use of the urlize filter in your templates. Instead, consider using Markdown to format user content. Additionally, implementing request timeouts and limiting process memory can help mitigate the impact of a potential attack.
References
Related vulnerabilities
Recent vulnerabilities recorded for jinja2.
