CVE-2023-26116

Name of the Vulnerable Software and Affected Versions angular versions 1.2.21 and later

Description The issue is related to the angular.copy() utility function, which uses an insecure regular expression. This can lead to a Regular Expression Denial of Service (ReDoS) via a large carefully-crafted input, resulting in catastrophic backtracking. Exploiting this issue is possible, allowing a remote attacker to cause a denial of service.

Recommendations For versions 1.2.21 and later, consider disabling the angular.copy() function until a patch is available to prevent potential exploitation. Restricting the input to the angular.copy() function can also help minimize the risk of catastrophic backtracking. As a temporary workaround, avoid using large inputs that could trigger the insecure regular expression. At the moment, there is no information about a newer version that contains a fix for this issue.