Weaknesses of type CWE-1333

484 results

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex com padrão mal construído que, em certos inputs, força o engine a testar bilhões de combinações antes de confirmar a rejeição. Isso consome CPU até paralisar o serviço, já que o tempo cresce exponencialmente com o tamanho da entrada.

Example

Uma validação de email como `(a+)+b` aplicada a uma string longa sem 'b' no final faz o engine tentar todas as combinações possíveis de agrupamento de 'a's antes de falhar — um input de 50 caracteres pode levar minutos para processar.

How to mitigate

Use ferramentas como `redos`, `regex-checker` ou testes de desempenho para validar regexes antes do deploy. Para casos simples (email, URL), prefira validadores específicos em vez de regex; se usar regex, limite o tamanho da entrada e adicione timeouts no engine.

CVE-2026-75880MEDIUMApache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of serviceEPSS 0.7%CVE-2026-23985MEDIUMApache Superset: Regular Expression Denial of Service (ReDoS) in SQL ParserEPSS 0.7%CVE-2025-3986MEDIUMApereo CAS CasConfigurationMetadataServerController.java redosEPSS 0.7%CVE-2026-80205HIGHNLTK before 3.10.0 ReDoS via Text.findall() unvalidated regexEPSS 0.7%CVE-2026-59928HIGHMistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitionsEPSS 0.7%CVE-2024-5552HIGHReDoS in kubeflow/kubeflowEPSS 0.6%CVE-2026-49477HIGHSoup Sieve: Regular Expression Denial of Service (ReDoS) in soupsieve Selector ParserEPSS 0.6%CVE-2026-110594MEDIUMBottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule RegexEPSS 0.6%CVE-2026-59922HIGHMistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)EPSS 0.6%CVE-2026-49293HIGHCPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literalsEPSS 0.6%CVE-2026-59925HIGHinline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairsEPSS 0.6%CVE-2023-6736MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.6%CVE-2024-25885HIGHAn issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) EPSS 0.6%CVE-2022-1929MEDIUMExponential ReDoS in devcertEPSS 0.6%CVE-2024-10550HIGHDenial of Service by ReDOS in h2oai/h2o-3EPSS 0.6%CVE-2024-10549HIGHDenial of Service by ReDOS in h2oai/h2o-3EPSS 0.6%CVE-2025-3985MEDIUMApereo CAS ResponseEntity redosEPSS 0.6%CVE-2024-50574MEDIUMIn JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionalityEPSS 0.6%CVE-2026-14741HIGHHTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_dateEPSS 0.6%CVE-2026-45756HIGHSymfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoSEPSS 0.6%