Vulnerability advisory

CVE-2022-24729

Regular expression Denial of Service in dialog plugin

Published Mar 16, 2022Updated Oct 28, 2026OSV record ↗

Also known as BIT-drupal-2022-24728BIT-drupal-2022-24729CVE-2022-24728DRUPAL-CORE-2022-005GHSA-4fc4-4p5g-6w89GHSA-f6rf-9m92-x2hh

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/ckeditor/ckeditor4 ↗
769d96134bcf29f5d3d870e25797ce9b9dc8289e to before 5fe059002f8c207df80b44ef999f3d1eec280694	`5fe059002f8c207df80b44ef999f3d1eec280694`
GIT github.com/ckeditor/ckeditor4-releases ↗
870a561110a23435d78eda377400dca7f64d3bd3 to before f7491490d73ee475b1aa4460c2449a148cb41ad1	`f7491490d73ee475b1aa4460c2449a148cb41ad1`
GIT github.com/drupal/drupal ↗
35c2f3ca5c935f3d8bde15932a712677c9bbd50f to before b68374146298b7277939e9c3208ab0518ff78d1a	`b68374146298b7277939e9c3208ab0518ff78d1a`
698ee686c23de8c97d7e0601cf745b220d54f4e1 to before aabeae28aa10e9a22ca903d140704846c1df161a	`aabeae28aa10e9a22ca903d140704846c1df161a`
Also listed as affected (118) `4.17.2` `4.17.1` `4.17.0` `4.16.0` `4.15.0` `4.14.0` `4.13.0` `4.12.0` `4.10.0` `4.8.0` `4.7.0` `4.6.0` `4.5.0` `4.5.0-beta` `4.4.1` `4.4.0` `4.2.3` `4.2.2` `4.2.1` `4.2.0` `4.2` `4.1.0` `4.1` `4.1rc` `4.0.1` `4.0.0` `4.0` `standard/4.17.2` `standard/4.17.1` `standard/4.17.0` `standard/4.16.2` `standard/4.16.1` `standard/4.16.0` `standard/4.15.1` `standard/4.15.0` `standard/4.14.1` `standard/4.14.0` `standard/4.13.1` `standard/4.13.0` `standard/4.12.1` `standard/4.12.0` `standard/4.11.4` `standard/4.11.3` `standard/4.11.2` `standard/4.11.1` `standard/4.11.0` `standard/4.10.1` `standard/4.10.0` `standard/4.9.2` `standard/4.9.1` `standard/4.9.0` `standard/4.8.0` `standard/4.7.3` `standard/4.7.2` `standard/4.7.1` `standard/4.7.0` `standard/4.6.2` `standard/4.6.1` `standard/4.6.0` `standard/4.5.11` `standard/4.5.10` `standard/4.5.9` `standard/4.5.8` `standard/4.5.7` `standard/4.5.6` `standard/4.5.5` `standard/4.5.4` `standard/4.5.3` `standard/4.5.2` `standard/4.5.1` `standard/4.5.0` `standard/4.4.8` `standard/4.4.7` `standard/4.4.6` `standard/4.4.5` `standard/4.4.4` `standard/4.4.3` `standard/4.4.2` `standard/4.4.1` `standard/4.4.0` `standard/4.3.5` `standard/4.3.4` `standard/4.3.3` `4.3.2/standard` `4.3.1/standard` `4.3.0/standard` `4.2.3/standard` `4.2.2/standard` `4.2.1/standard` `4.2/standard` `4.1.3/standard` `4.1.2/standard` `4.1.1/standard` `4.1/standard` `4.1rc/standard` `4.0.1/standard` `4.0/standard` `9.2.14` `9.3.7` `9.3.4` `9.2.10` `9.3.2` `9.3.0` `9.2.8` `9.2.7` `9.2.5` `9.2.3` `9.2.1` `9.2.0` `9.2.0-rc1` `9.2.0-beta3` `9.2.0-beta2` `9.2.0-beta1` `9.2.0-alpha1` `9.0.0-alpha2` `9.0.0-alpha1` `8.1.0-beta1` `8.0.0`

Description

CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the dialog plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.

CVE-2022-24729

Affected versions

Repository

Description

References