Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-y9aa-2a31-ufa7
Vulnerability ID VCID-y9aa-2a31-ufa7
Aliases CVE-2021-35065
GHSA-cj88-88mr-972w
GMS-2022-3113
Summary glob-parent 6.0.0 vulnerable to Regular Expression Denial of Service glob-parent 6.0.0 is vulnerable to Regular Expression Denial of Service (ReDoS). This issue is fixed in version 6.0.1. This vulnerability is separate from [GHSA-ww39-953v-wcq6](https://github.com/advisories/GHSA-ww39-953v-wcq6).
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1333 Inefficient Regular Expression Complexity
CWE-400 Uncontrolled Resource Consumption
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-35065.json
epss 0.00431 https://api.first.org/data/v1/epss?cve=CVE-2021-35065
epss 0.00431 https://api.first.org/data/v1/epss?cve=CVE-2021-35065
epss 0.00431 https://api.first.org/data/v1/epss?cve=CVE-2021-35065
epss 0.00624 https://api.first.org/data/v1/epss?cve=CVE-2021-35065
epss 0.00624 https://api.first.org/data/v1/epss?cve=CVE-2021-35065
epss 0.00624 https://api.first.org/data/v1/epss?cve=CVE-2021-35065
epss 0.00624 https://api.first.org/data/v1/epss?cve=CVE-2021-35065
epss 0.00624 https://api.first.org/data/v1/epss?cve=CVE-2021-35065
epss 0.00624 https://api.first.org/data/v1/epss?cve=CVE-2021-35065
epss 0.00624 https://api.first.org/data/v1/epss?cve=CVE-2021-35065
epss 0.00641 https://api.first.org/data/v1/epss?cve=CVE-2021-35065
epss 0.00641 https://api.first.org/data/v1/epss?cve=CVE-2021-35065
epss 0.00641 https://api.first.org/data/v1/epss?cve=CVE-2021-35065
epss 0.00641 https://api.first.org/data/v1/epss?cve=CVE-2021-35065
epss 0.00641 https://api.first.org/data/v1/epss?cve=CVE-2021-35065
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-cj88-88mr-972w
cvssv3.1 7.5 https://github.com/gulpjs/glob-parent
generic_textual HIGH https://github.com/gulpjs/glob-parent
cvssv3.1 7.5 https://github.com/gulpjs/glob-parent/commit/32f6d52663b7addac38d0dff570d8127edf03f47
generic_textual HIGH https://github.com/gulpjs/glob-parent/commit/32f6d52663b7addac38d0dff570d8127edf03f47
cvssv3.1 7.5 https://github.com/gulpjs/glob-parent/commit/3e9f04a3b4349db7e1962d87c9a7398cda51f339
generic_textual HIGH https://github.com/gulpjs/glob-parent/commit/3e9f04a3b4349db7e1962d87c9a7398cda51f339
ssvc Track https://github.com/gulpjs/glob-parent/commit/3e9f04a3b4349db7e1962d87c9a7398cda51f339
cvssv3.1 7.5 https://github.com/gulpjs/glob-parent/pull/49
generic_textual HIGH https://github.com/gulpjs/glob-parent/pull/49
ssvc Track https://github.com/gulpjs/glob-parent/pull/49
cvssv3.1 7.5 https://github.com/gulpjs/glob-parent/releases/tag/v6.0.1
generic_textual HIGH https://github.com/gulpjs/glob-parent/releases/tag/v6.0.1
cvssv3.1 7.5 https://github.com/opensearch-project/OpenSearch-Dashboards/issues/1103
generic_textual HIGH https://github.com/opensearch-project/OpenSearch-Dashboards/issues/1103
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2021-35065
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2021-35065
cvssv3.1 7.5 https://security.netapp.com/advisory/ntap-20230214-0010
generic_textual HIGH https://security.netapp.com/advisory/ntap-20230214-0010
cvssv3.1 7.5 https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294
generic_textual HIGH https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294
ssvc Track https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294
cvssv3.1 7.5 https://www.mend.io/vulnerability-database/CVE-2021-35065
generic_textual HIGH https://www.mend.io/vulnerability-database/CVE-2021-35065
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-35065.json
https://api.first.org/data/v1/epss?cve=CVE-2021-35065
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35065
https://github.com/gulpjs/glob-parent
https://github.com/gulpjs/glob-parent/commit/32f6d52663b7addac38d0dff570d8127edf03f47
https://github.com/gulpjs/glob-parent/commit/3e9f04a3b4349db7e1962d87c9a7398cda51f339
https://github.com/gulpjs/glob-parent/pull/36
https://github.com/gulpjs/glob-parent/pull/49
https://github.com/gulpjs/glob-parent/releases/tag/v5.1.2
https://github.com/gulpjs/glob-parent/releases/tag/v6.0.1
https://github.com/opensearch-project/OpenSearch-Dashboards/issues/1103
https://nvd.nist.gov/vuln/detail/CVE-2021-35065
https://security.netapp.com/advisory/ntap-20230214-0010
https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294
https://www.mend.io/vulnerability-database/CVE-2021-35065
2156324 https://bugzilla.redhat.com/show_bug.cgi?id=2156324
GHSA-cj88-88mr-972w https://github.com/advisories/GHSA-cj88-88mr-972w
RHSA-2023:0612 https://access.redhat.com/errata/RHSA-2023:0612
RHSA-2023:0634 https://access.redhat.com/errata/RHSA-2023:0634
RHSA-2023:0934 https://access.redhat.com/errata/RHSA-2023:0934
RHSA-2023:1533 https://access.redhat.com/errata/RHSA-2023:1533
RHSA-2023:1582 https://access.redhat.com/errata/RHSA-2023:1582
RHSA-2023:1583 https://access.redhat.com/errata/RHSA-2023:1583
RHSA-2023:1742 https://access.redhat.com/errata/RHSA-2023:1742
RHSA-2023:1743 https://access.redhat.com/errata/RHSA-2023:1743
RHSA-2023:2654 https://access.redhat.com/errata/RHSA-2023:2654
RHSA-2023:2655 https://access.redhat.com/errata/RHSA-2023:2655
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-35065.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/gulpjs/glob-parent
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/gulpjs/glob-parent/commit/32f6d52663b7addac38d0dff570d8127edf03f47
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/gulpjs/glob-parent/commit/3e9f04a3b4349db7e1962d87c9a7398cda51f339
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-14T14:52:03Z/ Found at https://github.com/gulpjs/glob-parent/commit/3e9f04a3b4349db7e1962d87c9a7398cda51f339
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/gulpjs/glob-parent/pull/49
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-14T14:52:03Z/ Found at https://github.com/gulpjs/glob-parent/pull/49
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/gulpjs/glob-parent/releases/tag/v6.0.1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/opensearch-project/OpenSearch-Dashboards/issues/1103
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-35065
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://security.netapp.com/advisory/ntap-20230214-0010
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-14T14:52:03Z/ Found at https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://www.mend.io/vulnerability-database/CVE-2021-35065
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.62509
EPSS Score 0.00431
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:07:16.828294+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-cj88-88mr-972w/GHSA-cj88-88mr-972w.json 38.0.0