Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-28g1-8vqv-1ugx

Summary

Incorrect Regular Expression
sshpk is vulnerable to ReDoS when parsing maliciously crafted invalid public keys.

Aliases

alias	CVE-2018-3737

alias	GHSA-2m39-62fm-q8r3

Fixed_packages

url	pkg:deb/debian/node-sshpk@1.13.1%2Bdfsg-2?distro=trixie
purl	pkg:deb/debian/node-sshpk@1.13.1%2Bdfsg-2?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/node-sshpk@1.13.1%252Bdfsg-2%3Fdistro=trixie

url	pkg:deb/debian/node-sshpk@1.16.1%2Bdfsg-2?distro=trixie
purl	pkg:deb/debian/node-sshpk@1.16.1%2Bdfsg-2?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/node-sshpk@1.16.1%252Bdfsg-2%3Fdistro=trixie

url	pkg:deb/debian/node-sshpk@1.17.0%2Bdfsg-2?distro=trixie
purl	pkg:deb/debian/node-sshpk@1.17.0%2Bdfsg-2?distro=trixie
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:deb/debian/node-sshpk@1.17.0%252Bdfsg-2%3Fdistro=trixie

url	pkg:npm/sshpk@1.13.2
purl	pkg:npm/sshpk@1.13.2
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.13.2

Affected_packages

url pkg:npm/sshpk@1.0.0

purl pkg:npm/sshpk@1.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.0.0

url pkg:npm/sshpk@1.0.1

purl pkg:npm/sshpk@1.0.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.0.1

url pkg:npm/sshpk@1.0.2

purl pkg:npm/sshpk@1.0.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.0.2

url pkg:npm/sshpk@1.0.3

purl pkg:npm/sshpk@1.0.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.0.3

url pkg:npm/sshpk@1.0.4

purl pkg:npm/sshpk@1.0.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.0.4

url pkg:npm/sshpk@1.1.0

purl pkg:npm/sshpk@1.1.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.1.0

url pkg:npm/sshpk@1.2.0

purl pkg:npm/sshpk@1.2.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.2.0

url pkg:npm/sshpk@1.2.1

purl pkg:npm/sshpk@1.2.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.2.1

url pkg:npm/sshpk@1.3.0

purl pkg:npm/sshpk@1.3.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.3.0

url pkg:npm/sshpk@1.4.0

purl pkg:npm/sshpk@1.4.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.4.0

url pkg:npm/sshpk@1.4.1

purl pkg:npm/sshpk@1.4.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.4.1

url pkg:npm/sshpk@1.4.2

purl pkg:npm/sshpk@1.4.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.4.2

url pkg:npm/sshpk@1.4.3

purl pkg:npm/sshpk@1.4.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.4.3

url pkg:npm/sshpk@1.4.4

purl pkg:npm/sshpk@1.4.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.4.4

url pkg:npm/sshpk@1.4.5

purl pkg:npm/sshpk@1.4.5

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.4.5

url pkg:npm/sshpk@1.4.6

purl pkg:npm/sshpk@1.4.6

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.4.6

url pkg:npm/sshpk@1.4.7

purl pkg:npm/sshpk@1.4.7

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.4.7

url pkg:npm/sshpk@1.5.0

purl pkg:npm/sshpk@1.5.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.5.0

url pkg:npm/sshpk@1.5.1

purl pkg:npm/sshpk@1.5.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.5.1

url pkg:npm/sshpk@1.6.0

purl pkg:npm/sshpk@1.6.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.6.0

url pkg:npm/sshpk@1.6.1

purl pkg:npm/sshpk@1.6.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.6.1

url pkg:npm/sshpk@1.6.2

purl pkg:npm/sshpk@1.6.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.6.2

url pkg:npm/sshpk@1.7.0

purl pkg:npm/sshpk@1.7.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.7.0

url pkg:npm/sshpk@1.7.1

purl pkg:npm/sshpk@1.7.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.7.1

url pkg:npm/sshpk@1.7.2

purl pkg:npm/sshpk@1.7.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.7.2

url pkg:npm/sshpk@1.7.3

purl pkg:npm/sshpk@1.7.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.7.3

url pkg:npm/sshpk@1.7.4

purl pkg:npm/sshpk@1.7.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.7.4

url pkg:npm/sshpk@1.8.0

purl pkg:npm/sshpk@1.8.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.8.0

url pkg:npm/sshpk@1.8.1

purl pkg:npm/sshpk@1.8.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.8.1

url pkg:npm/sshpk@1.8.2

purl pkg:npm/sshpk@1.8.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.8.2

url pkg:npm/sshpk@1.8.3

purl pkg:npm/sshpk@1.8.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.8.3

url pkg:npm/sshpk@1.9.0

purl pkg:npm/sshpk@1.9.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.9.0

url pkg:npm/sshpk@1.9.1

purl pkg:npm/sshpk@1.9.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.9.1

url pkg:npm/sshpk@1.9.2

purl pkg:npm/sshpk@1.9.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.9.2

url pkg:npm/sshpk@1.10.0

purl pkg:npm/sshpk@1.10.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.10.0

url pkg:npm/sshpk@1.10.1

purl pkg:npm/sshpk@1.10.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.10.1

url pkg:npm/sshpk@1.10.2

purl pkg:npm/sshpk@1.10.2

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.10.2

url pkg:npm/sshpk@1.11.0

purl pkg:npm/sshpk@1.11.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.11.0

url pkg:npm/sshpk@1.13.0

purl pkg:npm/sshpk@1.13.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.13.0

url pkg:npm/sshpk@1.13.1

purl pkg:npm/sshpk@1.13.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/sshpk@1.13.1

url pkg:rpm/redhat/rh-nodejs8-nodejs@8.17.0-2?arch=el7

purl pkg:rpm/redhat/rh-nodejs8-nodejs@8.17.0-2?arch=el7

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-28g1-8vqv-1ugx

vulnerability	VCID-3qmf-2f2m-fbes

vulnerability	VCID-9qdm-4xaz-qqhd

vulnerability	VCID-k3gg-stck-7ydy

vulnerability	VCID-k6bh-s1cq-n3a7

vulnerability	VCID-wb61-6cxb-5kfa

vulnerability	VCID-xja2-hbkk-cyc7

resource_url http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/rh-nodejs8-nodejs@8.17.0-2%3Farch=el7

References

reference_url

https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-3737.json

reference_id

reference_type

scores

value	5.3
scoring_system	cvssv3
scoring_elements	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

url

https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-3737.json

reference_url

https://api.first.org/data/v1/epss?cve=CVE-2018-3737

reference_id

reference_type

scores

value	0.00423
scoring_system	epss
scoring_elements	0.62167
published_at	2026-04-21T12:55:00Z

value	0.00423
scoring_system	epss
scoring_elements	0.62182
published_at	2026-04-18T12:55:00Z

value	0.00423
scoring_system	epss
scoring_elements	0.62177
published_at	2026-04-16T12:55:00Z

value	0.00423
scoring_system	epss
scoring_elements	0.62133
published_at	2026-04-13T12:55:00Z

value	0.00423
scoring_system	epss
scoring_elements	0.62154
published_at	2026-04-12T12:55:00Z

value	0.00423
scoring_system	epss
scoring_elements	0.62165
published_at	2026-04-11T12:55:00Z

value	0.00423
scoring_system	epss
scoring_elements	0.62145
published_at	2026-04-09T12:55:00Z

value	0.00423
scoring_system	epss
scoring_elements	0.62127
published_at	2026-04-08T12:55:00Z

value	0.00423
scoring_system	epss
scoring_elements	0.62077
published_at	2026-04-07T12:55:00Z

value	0.00423
scoring_system	epss
scoring_elements	0.62108
published_at	2026-04-04T12:55:00Z

value	0.00423
scoring_system	epss
scoring_elements	0.62017
published_at	2026-04-01T12:55:00Z

value	0.00423
scoring_system	epss
scoring_elements	0.62076
published_at	2026-04-02T12:55:00Z

url

https://api.first.org/data/v1/epss?cve=CVE-2018-3737

reference_url	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3737
reference_id
reference_type
scores
url	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3737

reference_url

https://github.com/advisories/GHSA-2m39-62fm-q8r3

reference_id

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

value	HIGH
scoring_system	cvssv3.1_qr
scoring_elements

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://github.com/advisories/GHSA-2m39-62fm-q8r3

reference_url

https://github.com/joyent/node-sshpk/blob/v1.13.1/lib/formats/ssh.js#L17

reference_id

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://github.com/joyent/node-sshpk/blob/v1.13.1/lib/formats/ssh.js#L17

reference_url

https://github.com/joyent/node-sshpk/commit/46065d38a5e6d1bccf86d3efb2fb83c14e3f9957

reference_id

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://github.com/joyent/node-sshpk/commit/46065d38a5e6d1bccf86d3efb2fb83c14e3f9957

reference_url

https://hackerone.com/reports/319593

reference_id

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://hackerone.com/reports/319593

reference_url

https://www.npmjs.com/advisories/606

reference_id

reference_type

scores

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://www.npmjs.com/advisories/606

reference_url	https://bugzilla.redhat.com/show_bug.cgi?id=1567228
reference_id	1567228
reference_type
scores
url	https://bugzilla.redhat.com/show_bug.cgi?id=1567228

reference_url	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901093
reference_id	901093
reference_type
scores
url	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901093

reference_url	https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:joyent:sshpk::::::node.js::*
reference_id	cpe:2.3:a:joyent:sshpk::::::node.js::*
reference_type
scores
url	https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:joyent:sshpk::::::node.js::*

reference_url

https://nvd.nist.gov/vuln/detail/CVE-2018-3737

reference_id

CVE-2018-3737

reference_type

scores

value	5.0
scoring_system	cvssv2
scoring_elements	AV:N/AC:L/Au:N/C:N/I:N/A:P

value	7.5
scoring_system	cvssv3.1
scoring_elements	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

value	HIGH
scoring_system	generic_textual
scoring_elements

url

https://nvd.nist.gov/vuln/detail/CVE-2018-3737

reference_url	https://access.redhat.com/errata/RHSA-2020:2625
reference_id	RHSA-2020:2625
reference_type
scores
url	https://access.redhat.com/errata/RHSA-2020:2625

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	185
name	Incorrect Regular Expression
description	The product specifies a regular expression in a way that causes data to be improperly matched or compared.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	770
name	Allocation of Resources Without Limits or Throttling
description	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

cwe_id	400
name	Uncontrolled Resource Consumption
description	The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

Exploits

Severity_range_score 5.0 - 8.9

Exploitability 0.5

Weighted_severity 8.0

Risk_score 4.0

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-28g1-8vqv-1ugx

Vulnerability Instance