CVE catalog
CVE-2021-26272
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugi
- Severity
- Medium · CVSS 6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 2.35% · Oct 25, 2026
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | ckeditor | bookworm | 4.19.1+dfsg-1 | fixed |
| Debian | ckeditor3 | bookworm | 3.6.6.1+dfsg-7 | not affected |
| Cpe | ckeditor | Not reported | 4.16 | fixed |
| Cpe | agile_product_lifecycle_management | Not reported | Not reported | unknown |
| Cpe | agile_product_lifecycle_management | Not reported | Not reported | unknown |
| Cpe | application_express | Not reported | 21.1.0 | fixed |
| Cpe | banking_party_management | Not reported | Not reported | unknown |
| Cpe | commerce_merchandising | Not reported | Not reported | unknown |
| Cpe | commerce_merchandising | Not reported | Not reported | unknown |
| Cpe | commerce_merchandising | Not reported | Not reported | unknown |
| Cpe | financial_services_analytical_applications_infrastructure | Not reported | Not reported | unknown |
| Cpe | financial_services_analytical_applications_infrastructure | Not reported | Not reported | unknown |
| Cpe | financial_services_analytical_applications_infrastructure | Not reported | Not reported | unknown |
| Cpe | financial_services_model_management_and_governance | Not reported | Not reported | unknown |
| Cpe | jd_edwards_enterpriseone_tools | Not reported | 9.2.6.0 | fixed |
| Cpe | siebel_ui_framework | Not reported | Not reported | unknown |
| Cpe | webcenter_sites | Not reported | Not reported | unknown |
| Cpe | webcenter_sites | Not reported | Not reported | unknown |
| Ubuntu | ckeditor | pro | 4.11.1+dfsg-1 | vulnerable |
| Ubuntu | ckeditor | pro | 4.12.1+dfsg-1 | vulnerable |
| Ubuntu | ckeditor | pro | 4.12.1+dfsg-1ubuntu0.1 | vulnerable |
| Ubuntu | ckeditor | pro | 4.12.1+dfsg-1ubuntu0.1+esm1 | vulnerable |
| Ubuntu | ckeditor | pro | 4.12.1+dfsg-1ubuntu0.1+esm2 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | ckeditor | source | bookworm | 4.16.0+dfsg-1 | not yet assigned | Not reported | [982587] |
| Debian | ckeditor3 | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Cpe | ckeditor | cpe | Not reported | 4.16 | Not reported | NVD-CVE-2021-26272 | Not reported |
| Cpe | application_express | cpe | Not reported | 21.1.0 | Not reported | NVD-CVE-2021-26272 | Not reported |
| Cpe | jd_edwards_enterpriseone_tools | cpe | Not reported | 9.2.6.0 | Not reported | NVD-CVE-2021-26272 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [ckeditor]Fixed
Details (2)
4.19.1+dfsg-1· all · bookwormFixed · Fixed:
4.16.0+dfsg-1nvd · ckeditor · debian · bookworm; nvd · ckeditor · debian · 12
4.19.1+dfsg-1· all · bookwormFixed · Fixed:
4.16.0+dfsg-1nvd · ckeditor · debian · bookworm; nvd · ckeditor · debian · 12
- [ckeditor3]Not affected
Details (2)
3.6.6.1+dfsg-7· all · bookwormNot affected
nvd · ckeditor3 · debian · bookworm
3.6.6.1+dfsg-7· all · bookwormNot affected
nvd · ckeditor3 · debian · bookworm
Observed:
References
- [https://nvd.nist.gov/vuln/detail/CVE-2021-26272]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2021-26272]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2021-26272]
- [https://security-tracker.debian.org/tracker/CVE-2021-26272]
- [https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-26272.json]
[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]