Weaknesses of type CWE-1333

415 results

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex com padrão mal construído que, em certos inputs, força o engine a testar bilhões de combinações antes de confirmar a rejeição. Isso consome CPU até paralisar o serviço, já que o tempo cresce exponencialmente com o tamanho da entrada.

Example

Uma validação de email como `(a+)+b` aplicada a uma string longa sem 'b' no final faz o engine tentar todas as combinações possíveis de agrupamento de 'a's antes de falhar — um input de 50 caracteres pode levar minutos para processar.

How to mitigate

Use ferramentas como `redos`, `regex-checker` ou testes de desempenho para validar regexes antes do deploy. Para casos simples (email, URL), prefira validadores específicos em vez de regex; se usar regex, limite o tamanho da entrada e adicione timeouts no engine.

CVE-2026-23956HIGHseroval affected by Denial of Service via RegExp serializationEPSS 0.5%CVE-2023-23925HIGHSwitcher Client contains Regular Expression Denial of Service (ReDoS)EPSS 0.5%CVE-2024-4025MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.5%CVE-2020-26303HIGHGHSL-2020-289: Regular Expression Denial of Service (ReDoS) in insaneEPSS 0.5%CVE-2020-26304HIGHGHSL-2020-290: Regular Expression Denial of Service (ReDoS) in foundation-sitesEPSS 0.5%CVE-2023-7279LOWSecure Systems Engineering Connaisseur Delegation Name targets_schema.json redosEPSS 0.5%CVE-2025-6493MEDIUMCodeMirror Markdown Mode markdown.js redosEPSS 0.5%CVE-2026-26996HIGHminimatch has a ReDoS via repeated wildcards with non-matching literal in patternEPSS 0.5%CVE-2024-27088NONEes5-ext Regular Expression Denial of Service in `function#copy` and `function#toStringTokens`EPSS 0.5%CVE-2025-6492MEDIUMMarkText index.js getRecommendTitleFromMarkdownString redosEPSS 0.5%CVE-2025-6638MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.5%CVE-2024-9506LOWRegular Expression Denial of Service (ReDoS)EPSS 0.5%CVE-2026-57584HIGHPhalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoSEPSS 0.5%CVE-2026-83606HIGHxmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructionsEPSS 0.5%CVE-2026-73556MEDIUMvLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574EPSS 0.5%CVE-2026-83619HIGHxmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parserEPSS 0.5%CVE-2026-48125MEDIUMUAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`EPSS 0.5%CVE-2024-36751MEDIUMAn issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL.EPSS 0.5%CVE-2026-87819HIGHGitPython before 3.1.60 Denial of Service via ReDoSEPSS 0.5%CVE-2020-26311HIGHGHSL-2020-312: Regular Expression Denial of Service (ReDoS) in useragentEPSS 0.5%