Inefficient Regular Expression Complexity in chocobozzz/peertube


Reported on

Sep 16th 2021


Hello Again dear Peertube team.

I found inefficient regular expression in that have a Polynomial execution time that can be lead to ReDoS attacks and it is better to replace it with another regex or Use google re2 regex engine for server sides code.

Proof of Concept

I create two payloads that you can compare the execution times between them in Regexr provided links.

payload 1 : normal input

payload 2 : the crafted bad input with length = payload 1

Also if you see error from execution time in this means that the execution time is greater that 250 millisecond.


We have contacted a member of the chocobozzz/peertube team and are waiting to hear back 3 months ago
2 months ago


dear puretube team, if you want any more explanation just tell me

chocobozzz validated this vulnerability 2 months ago
amammad has been awarded the disclosure bounty
The fix bounty is now up for grabs
2 months ago


Thanks, and sorry for the late answer.

chocobozzz confirmed that a fix has been merged on e5d987 2 months ago
chocobozzz has been awarded the fix bounty
oembed.ts#L31 has been validated