Weaknesses of type CWE-1333

415 results

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex com padrão mal construído que, em certos inputs, força o engine a testar bilhões de combinações antes de confirmar a rejeição. Isso consome CPU até paralisar o serviço, já que o tempo cresce exponencialmente com o tamanho da entrada.

Example

Uma validação de email como `(a+)+b` aplicada a uma string longa sem 'b' no final faz o engine tentar todas as combinações possíveis de agrupamento de 'a's antes de falhar — um input de 50 caracteres pode levar minutos para processar.

How to mitigate

Use ferramentas como `redos`, `regex-checker` ou testes de desempenho para validar regexes antes do deploy. Para casos simples (email, URL), prefira validadores específicos em vez de regex; se usar regex, limite o tamanho da entrada e adicione timeouts no engine.

CVE-2025-2099MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.6%CVE-2026-68497HIGHjackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of serviceEPSS 0.6%CVE-2025-7074MEDIUMvercel hyper rimraf-standalone.js ignoreMap redosEPSS 0.6%CVE-2026-57577HIGHDotVVM: ReDOS in routingEPSS 0.6%CVE-2025-48059LOWPowSyBl Core Contains a Polynomial ReDoS in RegexCriterionEPSS 0.6%CVE-2024-1963MEDIUMUncontrolled Resource Consumption in GitLabEPSS 0.6%CVE-2024-1495MEDIUMUncontrolled Resource Consumption in GitLabEPSS 0.6%CVE-2026-35213HIGHRegular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsingEPSS 0.6%CVE-2024-1736MEDIUMUncontrolled Resource Consumption in GitLabEPSS 0.6%CVE-2026-70489MEDIUMOpen WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsingEPSS 0.6%CVE-2026-59220MEDIUMOpen WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default configEPSS 0.6%CVE-2025-5889LOWjuliangruber brace-expansion index.js expand redosEPSS 0.6%CVE-2023-25167MEDIUMRegular expression denial of service via installing themes via git in discourseEPSS 0.6%CVE-2026-44796MEDIUMNautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)EPSS 0.6%CVE-2026-86081HIGHn8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone PathEPSS 0.6%CVE-2025-68475HIGHFedify has ReDoS Vulnerability in HTML Parsing RegexEPSS 0.6%CVE-2024-1892HIGHReDoS Vulnerability in scrapy/scrapy's XMLFeedSpiderEPSS 0.6%CVE-2026-74039HIGHWazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_contextEPSS 0.6%CVE-2025-27789MEDIUMInefficient RexExp complexity in generated code with .replace when transpiling named capturing groupsEPSS 0.6%CVE-2026-58578HIGHLobeChat < 2.2.10-canary.15 - Regular Expression Denial of Service in GitHub Skill ImportEPSS 0.5%