WS-2017-3772 | Mend Vulnerability Database

Vulnerability DatabaseWS-2017-3772

WS-2017-3772

Published:May 20, 2026

Updated:May 20, 2026

Regular Expression Denial of Service (ReDoS) vulnerability was found in underscore.string 2.4.0 through 3.3.5.

Affected Packages

underscore.string (CDN_JS):

Affected version(s) >=3.0.0 <3.3.6

Fix Suggestion:

Update to version 3.3.6

grunt (CONDA):

Affected version(s) =1.0.4

Fix Suggestion:

Update to version no_fix

jsdom (CONDA):

Affected version(s) =11.0.0 <11.11.0

Fix Suggestion:

Update to version 11.11.0

underscore.string (NPM):

Affected version(s) >=3.0.0 <3.3.6

Fix Suggestion:

Update to version 3.3.6

tslint (NUGET):

Affected version(s) >=3.11.0 <4.5.1

Fix Suggestion:

Update to version 4.5.1

entityframework.lookuptables (NUGET):

Affected version(s) >=1.1.12.119 <1.1.14.119

Fix Suggestion:

Update to version 1.1.14.119

newplatform.flexberry.designer.embercache (NUGET):

Affected version(s) =3.7.0-beta09

Fix Suggestion:

Update to version no_fix

midiator.webclient (NUGET):

Affected version(s) >=1.0.98 <1.0.105

Fix Suggestion:

Update to version 1.0.105

tribalsystems/zenario (PHP):

Affected version(s) >=9.0.x-dev <9.0.55141

Fix Suggestion:

Update to version 9.0.55141

limefamily/yii2-limetheme (PHP):

Affected version(s) >=1.0.0 <1.0.12

Fix Suggestion:

Update to version 1.0.12

xenomedia/xeno-base (PHP):

Affected version(s) =dev-master <0.0.1

Fix Suggestion:

Update to version 0.0.1

frankyframework/franky2 (PHP):

Affected version(s) =dev-main

Fix Suggestion:

Update to version no_fix

sombrerodepaja/franky-skeleton-application (PHP):

Affected version(s) >=dev-dependabot/npm_and_yarn/engine.io-and-browser-sync-6.2.1 <=dev-dependabot/npm_and_yarn/qs-and-grunt-contrib-watch-6.4.1

Fix Suggestion:

Update to version no_fix

awesome-support/awesome-support (PHP):

Affected version(s) =dev-gas_php81_fixerror <dev-issue/233

Fix Suggestion:

Update to version dev-issue/233

tribalsystems/zenario (PHP):

Affected version(s) >=9.0.57473 <9.1.55143

Fix Suggestion:

Update to version 9.1.55143

triawarman/yii2-richfilemanager (PHP):

Affected version(s) >=dev-bckp-develop <v0.1

Fix Suggestion:

Update to version v0.1

seidemann-web/wave-theme (PHP):

Affected version(s) >=dev-WT-27/sticky-header <dev-WT-36/Sticky-Header-Fixes

Fix Suggestion:

Update to version dev-WT-36/Sticky-Header-Fixes

xenomedia/xeno-base (PHP):

Affected version(s) >=0.0.3 <=0.0.4

Fix Suggestion:

Update to version no_fix

ymcatwincities/openy-cibox-vm (PHP):

Affected version(s) >=dev-snyk-fix-19013f5e293df9c71f68bf9631fba9f2 <dev-snyk-fix-45a393004964497d68443389076d755a

Fix Suggestion:

Update to version dev-snyk-fix-45a393004964497d68443389076d755a

tribalsystems/zenario (PHP):

Affected version(s) >=9.2.57169 <9.5.x-dev

Fix Suggestion:

Update to version 9.5.x-dev

yivic/yivic-elce (PHP):

Affected version(s) >=dev-fixbug/TVNnWKJz-wp-elce-admin-options-header-error-styles-ui-again <=dev-origin/v1.0.1

Fix Suggestion:

Update to version no_fix

ymcatwincities/openy-cibox-vm (PHP):

Affected version(s) =dev-snyk-upgrade-c10ea3c8666b5b22429d3e747ff879aa <dev-snyk-fix-5c35a6fcce9a99be5f2075759c8a3425

Fix Suggestion:

Update to version dev-snyk-fix-5c35a6fcce9a99be5f2075759c8a3425

seidemann-web/wave-theme (PHP):

Affected version(s) =dev-bugfix/variants-fix <dev-fixUpLanguageConstants

Fix Suggestion:

Update to version dev-fixUpLanguageConstants

tribalsystems/zenario (PHP):

Affected version(s) =dev-latest-public-release <7.0.2e

Fix Suggestion:

Update to version 7.0.2e

ymcatwincities/openy-cibox-vm (PHP):

Affected version(s) =dev-master <dev-snyk-fix-d3e304fdb18d8e743e047d064f2eeebe

Fix Suggestion:

Update to version dev-snyk-fix-d3e304fdb18d8e743e047d064f2eeebe

seidemann-web/wave-theme (PHP):

Affected version(s) =dev-motorrad <dev-omage-theme

Fix Suggestion:

Update to version dev-omage-theme

oxid-esales/wave-theme (PHP):

Affected version(s) =dev-motorrad <dev-oxscript-google-analytics

Fix Suggestion:

Update to version dev-oxscript-google-analytics

seidemann-web/wave-theme (PHP):

Affected version(s) =dev-feature/WT-21

Fix Suggestion:

Update to version no_fix

tribalsystems/zenario (PHP):

Affected version(s) >=8.6.x-dev <8.9.55141

Fix Suggestion:

Update to version 8.9.55141

Related Resources (1)

https://github.com/esamattis/underscore.string/issues/510

Do you need more information?

CVSS v4

Base Score:

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

NONE

Vulnerable System Confidentiality

NONE

Vulnerable System Integrity

NONE

Vulnerable System Availability

HIGH

Subsequent System Confidentiality

NONE

Subsequent System Integrity

NONE

Subsequent System Availability

NONE

CVSS v3

Base Score:

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH