UpHeron
All vulnerabilities

Servers and applications

CVE-2021-32763

Regular Expression Denial of Service in OpenProject forum messages

Severity
Medium 6.5
Published
20 Jul 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
11.3.3
Also known as
GHSA-qqvp-j6gm-q56f
Sources
NVD, Project advisories (GitHub)

Description

OpenProject is open-source, web-based project management software. In versions prior to 11.3.3, the `MessagesController` class of OpenProject has a `quote` method that implements the logic behind the Quote button in the discussion forums, and it uses a regex to strip `<pre>` tags from the message being quoted. The `(.|\s)` part can match a space character in two ways, so an unterminated `<pre>`…

Affected software

SoftwareAffected versions
OpenProjectServers and applications · cpe:a:openproject:openproject
  • Every version before 11.3.3
OpenProjectServers and applications · github:opf/openproject
  • Every version before 11.3.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-32763
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-32763
  • GitHub Advisory Database https://github.com/advisories/GHSA-qqvp-j6gm-q56f
  • github.com https://github.com/opf/openproject/security/advisories/GHSA-qqvp-j6gm-q56f