CVE-2017-16137: Debug Project Debug

Medium severity, CVSS 5.3. EPSS: 2.9% chance of exploitation in the next 30 days.

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Affected products

• Debug Project Debug: from 2.0.0, before 2.6.9 (fixed in 2.6.9); from 3.0.0, before 3.1.0 (fixed in 3.1.0)

Published 2018-06-07. Last modified 2026-06-17.