CVE-2020-6817: Mozilla Bleach

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).

Affected products

• Mozilla Bleach: before 3.1.4 (fixed in 3.1.4)

Published 2023-02-16. Last modified 2026-06-17.