CVE-2021-41115
CVE-2021-41115 is a medium-severity vulnerability in Zulip with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1333.
Key facts
- Severity: Medium (CVSS 3.x base score 4.3)
- CVSS v2: 4.0
- EPSS exploit prediction: 2% (74th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-1333
- Affected product: Zulip
- Published:
- Last modified:
Description
Zulip is an open source team chat server. In affected versions Zulip allows organization administrators on a server to configure "linkifiers" that automatically create links from messages that users send, detected via arbitrary regular expressions. Malicious organization administrators could subject the server to a denial-of-service via regular expression complexity attacks; most simply, by configuring a quadratic-time regular expression in a linkifier, and sending messages that exploited it. A regular expression attempted to parse the user-provided regexes to verify that they were safe from ReDoS -- this was both insufficient, as well as _itself_ subject to ReDoS if the organization administrator entered a sufficiently complex invalid regex. Affected users should [upgrade to the just-released Zulip 4.7](https://zulip.readthedocs.io/en/latest/production/upgrade-or-modify.html#upgrading-to-a-release), or [`main`](https://zulip.readthedocs.io/en/latest/production/upgrade-or-modify.html#upgrading-from-a-git-repository).
Frequently asked questions
- What is CVE-2021-41115?
- Zulip is an open source team chat server. In affected versions Zulip allows organization administrators on a server to configure "linkifiers" that automatically create links from messages that users send, detected via arbitrary regular expressions. Malicious organization administrators could subject the server to a denial-of-service via regular expression complexity attacks; most simply, by configuring a quadratic-time regular expression in a linkifier, and sending messages that exploited it. A regular expression attempted to parse the user-provided regexes to verify that they were safe from ReDoS -- this was both insufficient, as well as _itself_ subject to ReDoS if the organization administrator entered a sufficiently complex invalid regex. Affected users should [upgrade to the just-released Zulip 4.7](https://zulip.readthedocs.io/en/latest/production/upgrade-or-modify.html#upgrading-to-a-release), or [`main`](https://zulip.readthedocs.io/en/latest/production/upgrade-or-modify.html#upgrading-from-a-git-repository).
- How severe is CVE-2021-41115?
- CVE-2021-41115 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
- Is CVE-2021-41115 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (74th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2021-41115?
- CVE-2021-41115 affects Zulip. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2021-41115?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2021-41115 published?
- CVE-2021-41115 was published on 2021-10-07 and last updated on 2026-06-17.
References
- https://github.com/zulip/zulip/commit/e2d303c1bb5f538d17dc3d9134bc8858bdece781
- https://github.com/zulip/zulip/security/advisories/GHSA-4h36-mqfq-42jg
- https://securitylab.github.com/advisories/GHSL-2021-118-zulip-zulip/
Affected products (1)
- cpe:2.3:a:zulip:zulip:*:*:*:*:*:*:*:*
More vulnerabilities in Zulip
- CVE-2021-3967 — High (CVSS 8.8): Improper Access Control in GitHub repository zulip/zulip prior to 4.10.
- CVE-2021-43799 — High (CVSS 8.6): Zulip is an open-source team collaboration tool. Zulip Server installs RabbitMQ for internal message passing. In…
- CVE-2022-35962 — High (CVSS 8.0): Zulip is an open source team chat and Zulip Mobile is an app for iOS and Andriod users. In Zulip Mobile through version…
- CVE-2016-4427 — High (CVSS 7.5): In zulip before 1.3.12, deactivated users could access messages if SSO was enabled.
- CVE-2023-28623 — Medium (CVSS 6.5): Zulip is an open-source team collaboration tool with unique topic-based threading. In the event that 1:…
- CVE-2021-43791 — Medium (CVSS 6.5): Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected…
Other CWE-1333 vulnerabilities
- CVE-2026-35458 — Critical (CVSS 9.8): Gotenberg is an API for converting document formats. In 8.29.1 and earlier, Gotenberg uses dlclark/regexp2 to compile…
- CVE-2023-29486 — Critical (CVSS 9.8): An issue was discovered in Heimdal Thor agent versions 3.4.2 and before 3.7.0 on Windows, allows attackers to bypass…
- CVE-2026-25547 — Critical (CVSS 9.2): @isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1,…
- CVE-2023-29487 — Critical (CVSS 9.1): An issue was discovered in Heimdal Thor agent versions 3.4.2 and before on Windows and 2.6.9 and before on macOS,…
- CVE-2026-47138 — High (CVSS 8.7): Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to…
- CVE-2025-6998 — High (CVSS 8.7): ReDoS in strip_whitespaces() function in cps/string_helper.py in Calibre Web and Autocaliweb allows unauthenticated…