Weaknesses of type CWE-1333

415 results

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex com padrão mal construído que, em certos inputs, força o engine a testar bilhões de combinações antes de confirmar a rejeição. Isso consome CPU até paralisar o serviço, já que o tempo cresce exponencialmente com o tamanho da entrada.

Example

Uma validação de email como `(a+)+b` aplicada a uma string longa sem 'b' no final faz o engine tentar todas as combinações possíveis de agrupamento de 'a's antes de falhar — um input de 50 caracteres pode levar minutos para processar.

How to mitigate

Use ferramentas como `redos`, `regex-checker` ou testes de desempenho para validar regexes antes do deploy. Para casos simples (email, URL), prefira validadores específicos em vez de regex; se usar regex, limite o tamanho da entrada e adicione timeouts no engine.

CVE-2024-6038HIGHReDoS Vulnerability in gaizhenbiao/chuanhuchatgptEPSS 0.7%CVE-2026-23897HIGHApollo Server is vulnerable to denial of service with `startStandaloneServer`EPSS 0.7%CVE-2026-67422HIGHpymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processorsEPSS 0.7%CVE-2026-59928HIGHMistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitionsEPSS 0.7%CVE-2024-5552HIGHReDoS in kubeflow/kubeflowEPSS 0.6%CVE-2022-34402MEDIUMDell Wyse ThinOS 2205 contains a Regular Expression Denial of Service Vulnerability in UI. An admin privilege attacker could potentially expEPSS 0.6%CVE-2026-49293HIGHCPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literalsEPSS 0.6%CVE-2026-59922HIGHMistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)EPSS 0.6%CVE-2026-59925HIGHinline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairsEPSS 0.6%CVE-2023-6736MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.6%CVE-2024-25885HIGHAn issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) EPSS 0.6%CVE-2025-5891MEDIUMUnitech pm2 Config.js redosEPSS 0.6%CVE-2025-3986MEDIUMApereo CAS CasConfigurationMetadataServerController.java redosEPSS 0.6%CVE-2022-1929MEDIUMExponential ReDoS in devcertEPSS 0.6%CVE-2024-50574MEDIUMIn JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionalityEPSS 0.6%CVE-2026-62317HIGHLogto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing)EPSS 0.6%CVE-2026-14895HIGHString::Util versions before 1.36 for Perl are susceptible to a regular expression denial of serviceEPSS 0.6%CVE-2026-49851HIGHMistune: Potential DoS via quadratic-time parsing in parse_link_textEPSS 0.6%CVE-2026-45756HIGHSymfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoSEPSS 0.6%CVE-2026-89407HIGHjackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoSEPSS 0.6%