CVE-2021-26272: Ckeditor

Medium severity, CVSS 6.5. EPSS: 2.3% chance of exploitation in the next 30 days.

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).

Affected products

• Ckeditor Ckeditor: from 4.0, before 4.16 (fixed in 4.16)
• Oracle Agile Product Lifecycle Management: version 9.3.5 only; version 9.3.6 only
• Oracle Application Express: before 21.1.0 (fixed in 21.1.0)
• Oracle Banking Party Management: version 2.7.0 only
• Oracle Commerce Merchandising: from 11.3.0, up to and including 11.3.2; version 11.1.0 only; version 11.2.0 only
• Oracle Financial Services Analytical Applications Infrastructure: from 8.0.6, up to and including 8.0.9; version 8.1.0 only; version 8.1.1 only
• Oracle Financial Services Model Management And Governance: from 8.0.8.0.0, up to and including 8.1.0.0.0
• Oracle Jd Edwards Enterpriseone Tools: before 9.2.6.0 (fixed in 9.2.6.0)
• Oracle Siebel UI Framework: up to and including 21.9
• Oracle Webcenter Sites: version 12.2.1.3.0 only; version 12.2.1.4.0 only

Published 2021-01-26. Last modified 2026-08-25.