Weaknesses of type CWE-1333

415 results

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex com padrão mal construído que, em certos inputs, força o engine a testar bilhões de combinações antes de confirmar a rejeição. Isso consome CPU até paralisar o serviço, já que o tempo cresce exponencialmente com o tamanho da entrada.

Example

Uma validação de email como `(a+)+b` aplicada a uma string longa sem 'b' no final faz o engine tentar todas as combinações possíveis de agrupamento de 'a's antes de falhar — um input de 50 caracteres pode levar minutos para processar.

How to mitigate

Use ferramentas como `redos`, `regex-checker` ou testes de desempenho para validar regexes antes do deploy. Para casos simples (email, URL), prefira validadores específicos em vez de regex; se usar regex, limite o tamanho da entrada e adicione timeouts no engine.

CVE-2026-30837HIGHElysia has a string URL format redosEPSS 0.5%CVE-2026-48801HIGHlinkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loopEPSS 0.5%CVE-2020-26308HIGHGHSL-2020-302: Regular Expression Denial of Service (ReDoS) in validate.jsEPSS 0.5%CVE-2026-55520HIGHProtego: Exponential backtracking ReDoS in robots.txt URL wildcard matchingEPSS 0.5%CVE-2025-0367MEDIUMRegular Expression Denial of Service (ReDoS) in Splunk Supporting Add-on for Active Directory (SA-ldapsearch)EPSS 0.5%CVE-2026-66766HIGHDenial of Service (DoS) in SAP S/4HANA (Manage Supply Protection)EPSS 0.5%CVE-2026-67991HIGHcrmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition EPSS 0.5%CVE-2026-85062MEDIUMColord: Slow rejection of oversized malformed color stringsEPSS 0.5%CVE-2026-66062MEDIUMSvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept headerEPSS 0.5%CVE-2025-48887MEDIUMvLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py`EPSS 0.5%CVE-2026-26936MEDIUMInefficient Regular Expression Complexity in Kibana Leading to Denial of ServiceEPSS 0.5%CVE-2023-6502MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.5%CVE-2024-21539HIGHVersions of the package @eslint/plugin-kit before 0.2.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper inputEPSS 0.5%CVE-2025-46560MEDIUMvLLM phi4mm: Quadratic Time Complexity in Input Token Processing​ leads to denial of serviceEPSS 0.5%CVE-2025-69873LOWajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enaEPSS 0.5%CVE-2026-77422HIGHJLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` WrappingEPSS 0.5%CVE-2025-61921LOWSinatra has ReDoS vulnerability in ETag header value generationEPSS 0.5%CVE-2026-79770HIGHNokogiri before 1.19.3 ReDoS via CSS selector tokenizerEPSS 0.5%CVE-2024-1493MEDIUMUncontrolled Resource Consumption in GitLabEPSS 0.5%CVE-2026-33671HIGHPicomatch has a ReDoS vulnerability via extglob quantifiersEPSS 0.5%