Skip to content
Fencer Intel
medium 5.3

CVE-2024-21503 json

Black vulnerable to Regular Expression Denial of Service (ReDoS)

published 2y ago modified 2mo ago also EUVD-2024-0019 , GHSA-fj7x-q9j7-g6q6 , PYSEC-2024-48

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 62%
public exploits
0
none known

Summary

Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.

Patch / fix

  • pypi black 24.3.0
  • n/a black 24.3.0
  • python_software_foundation black 24.3.0
  • black Debian 14, Debian 13 24.4.0-1

debian advisories DEBIAN-CVE-2024-21503

  • receptor ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.8-1.el8ap
  • receptor ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.8-1.el9ap
  • python-idna ansible automation platform developer 2.4, ansible automation platform 2.4 3.7-1.el9ap
  • receptorctl ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.8-1.el8ap
  • receptorctl ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 1.4.8-1.el9ap
  • python-black ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 22.8.0-2.el9ap
  • python3-idna ansible automation platform developer 2.4, ansible automation platform 2.4 3.7-1.el9ap
  • python-jinja2 ansible automation platform inside 2.4, ansible automation platform developer 2.4, ansible automation platform 2.4 3.1.4-1.el9ap

red hat advisories RHSA-2024:3781

  • python-black openSUSE Leap 15.6 24.3.0-150400.9.8.1

suse advisories SUSE-SU-2024:2481-1

  • python-black openSUSE Tumbleweed 26.5.1-1.3

opensuse advisories openSUSE-SU-2026:12001-1

  • black Alpine 3.19 23.12.0-r0
  • black Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 24.3.0-r0

alpine advisories ALPINE-CVE-2024-21503

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2024-21503 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-21503 updated cvss 5.3

psf/black: ReDoS via the lines_with_leading_tabs_expanded() function in strings.py file

  • Red Hat Ansible Automation Platform 2.4 for RHEL 8 python39-black 22.8.0-2.el8ap, python3x-black 22.8.0-2.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 python-black 22.8.0-2.el9ap, python3-black 22.8.0-2.el9ap
    fixed: vendor fix RHSA-2024:3781
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8 receptor 1.4.8-1.el8ap, python39-idna 3.7-1.el8ap, python3x-idna 3.7-1.el8ap, receptorctl 1.4.8-1.el8ap, ansible-core 2.15.11-1.el8ap, ansible-test 2.15.11-1.el8ap, +37 more Red Hat Ansible Automation Platform 2.4 for RHEL 9 receptor 1.4.8-1.el9ap, python-idna 3.7-1.el9ap, python3-idna 3.7-1.el9ap, receptorctl 1.4.8-1.el9ap, python-jinja2 3.1.4-1.el9ap, ansible-core 2.15.11-1.el9ap, +37 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
2y ago

Exploit prediction

0.98% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
pypi black
<24.3.0
24.3.0

Affected products

  • n/a black
  • python_software_foundation black

Classification

Weakness
  • CWE-1333 Inefficient Regular Expression Complexity
  • CWE-75 Failure to Sanitize Special Elements into a Different Plane

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.