PyPI/bleach CVE-2020-6817: high 7.5, EPSS 0.72%

regular expression denial-of-service (ReDoS) in Bleach

Action: Upgrade bleach to 3.1.4 or later.

pip install bleach==3.1.4

Affected

Fixed versions

Sources

• osv: GHSA-vqhp-cxgc-6wmm
• https://github.com/mozilla/bleach/security/advisories/GHSA-vqhp-cxgc-6wmm
• https://nvd.nist.gov/vuln/detail/CVE-2020-6817
• https://bugzilla.mozilla.org/show_bug.cgi?id=1623633
• https://github.com/mozilla/bleach
• https://github.com/mozilla/bleach/releases/tag/v3.1.4
• https://github.com/pypa/advisory-database/tree/main/vulns/bleach/PYSEC-2020-340.yaml
• https://snyk.io/vuln/SNYK-PYTHON-BLEACH-561754

CVE-2020-6817 · published 2020-03-30T19:45:56Z · modified 2026-09-10T03:48:29.583864458Z · JSON