Inefficient regular expression complexity in Bleach - #VU133465
Published: June 8, 2026
Vulnerability identifier: #VU133465
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to inefficient regular expression complexity in LinkifyFilter.handle_email_addresses() and EMAIL_RE processing in bleach/linkifier.py when parsing attacker-controlled text with email linkification enabled. A remote user can submit specially crafted text to cause a denial of service.
Only applications that enable parse_email=True on untrusted text are affected.
Affected software
Bleach
Remediation
Install security update from vendor's website.
Bleach - update to 6.4.0