CVE-2023-1894: Puppet Enterprise

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted certificate names significantly slowed down server operations.

Affected products

• Puppet Puppet Enterprise: version 2021.7.1 only; version 2023.0 only
• Puppet Puppet Server: version 7.9.2 only

Published 2023-05-04. Last modified 2026-06-17.