CVE-2023-1894

5.3 mediumEPSS 0.4%

Medium (5.3) in puppet. EPSS 0.4% chance of exploitation in the next 30 days.

A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted certificate names significantly slowed down server operations.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
CWE: CWE-1333
Published: 2023-05-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

puppet:puppet_enterprise
puppet:puppet_server

References

https://www.puppet.com/security/cve/cve-2023-1894-puppet-server-redos
https://www.puppet.com/security/cve/cve-2023-1894-puppet-server-redos

Check your stack JSON