{"id":"CVE-2021-32838","aliases":["GHSA-3q6g-vf58-7m4g","PYSEC-2021-325"],"title":"Regular Expression Denial of Service in flask-restx","summary":"Regular Expression Denial of Service in flask-restx","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"flask-restx","product":"flask-restx","ecosystem":"pip","affected":["flask-restx < 0.5.1"],"patched":["flask-restx 0.5.1"],"published":"2021-09-08","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-3q6g-vf58-7m4g","references":[{"url":"https://github.com/python-restx/flask-restx/security/advisories/GHSA-3q6g-vf58-7m4g"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32838"},{"url":"https://github.com/python-restx/flask-restx/issues/372"},{"url":"https://github.com/python-restx/flask-restx/commit/bab31e085f355dd73858fd3715f7ed71849656da"},{"url":"https://github.com/advisories/GHSA-3q6g-vf58-7m4g"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/flask-restx/PYSEC-2021-325.yaml"},{"url":"https://github.com/python-restx/flask-restx"},{"url":"https://github.com/python-restx/flask-restx/blob/fd99fe11a88531f5f3441a278f7020589f9d2cc0/flask_restx/inputs.py#L51"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5UCTFVDU3677B5OBGK4EF5NMUPJLL6SQ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QUD6SWZLX52AAZUHDETJ2CDMQGEPGFL3"},{"url":"https://pypi.org/project/flask-restx"}],"tags":["osv","pip"],"epss":0.01864,"epssPercentile":0.78384,"ingestedAt":"2026-07-08T18:25:44.940Z","slug":"CVE-2021-32838","body":"## Overview\n\nFlask RESTX contains a regular expression that is vulnerable to [ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) (Regular Expression Denial of Service) in `email_regex`.\n\n\n## Affected packages\n\n- `flask-restx < 0.5.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `flask-restx 0.5.1`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.4,"exploitation":0,"ransomware":0},"changes":[]}