CVE-2023-26103: 
Rust vulnerability analysis and mitigation

CVE-2023-26103 affects versions of the Deno package before 1.31.0. The vulnerability was discovered in February 2023 and involves a Regular Expression Denial of Service (ReDoS) issue in the upgradeWebSocket function. The vulnerability specifically affects the Connection/Upgrade header processing functionality in Deno's HTTP implementation (NVD, Snyk).

The vulnerability exists in the upgradeWebSocket function, which uses regular expressions in the form of /s,s/ for splitting the Connection/Upgrade header. The implementation contains regexes that can be exploited through specially crafted Connection/Upgrade headers. The vulnerability has a CVSS base score of 7.5 (high) according to NVD, while Snyk rates it at 5.3 (medium) (Snyk).

When exploited, this vulnerability can significantly slow down a web socket server's performance. The attack can cause the service to excessively consume CPU resources, leading to reduced performance or partial service interruptions. While the attacker cannot completely deny service to legitimate users, they can cause the resources to be either partially available or experience intermittent disruptions (Snyk).

The vulnerability was fixed in Deno version 1.31.0. The recommended mitigation is to upgrade Deno to version 1.31.0 or higher. The fix involved replacing the regex-based approach with String.prototype.trim() for processing the Connection/Upgrade header (GitHub Commit).