Weaknesses of type CWE-1333

415 results

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex com padrão mal construído que, em certos inputs, força o engine a testar bilhões de combinações antes de confirmar a rejeição. Isso consome CPU até paralisar o serviço, já que o tempo cresce exponencialmente com o tamanho da entrada.

Example

Uma validação de email como `(a+)+b` aplicada a uma string longa sem 'b' no final faz o engine tentar todas as combinações possíveis de agrupamento de 'a's antes de falhar — um input de 50 caracteres pode levar minutos para processar.

How to mitigate

Use ferramentas como `redos`, `regex-checker` ou testes de desempenho para validar regexes antes do deploy. Para casos simples (email, URL), prefira validadores específicos em vez de regex; se usar regex, limite o tamanho da entrada e adicione timeouts no engine.

CVE-2026-27904HIGHminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressionsEPSS 0.5%CVE-2026-41040HIGHGROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via a crafted input string.EPSS 0.5%CVE-2025-68142LOWPyMdown Extensions has ReDOS bug in Figure Capture extensionEPSS 0.5%CVE-2026-16270MEDIUMReDoS in Open MercatoEPSS 0.5%CVE-2025-71379MEDIUMvllm - Regular Expression Denial of Service in Multiple ComponentsEPSS 0.5%CVE-2025-9670MEDIUMmixmark-io turndown commonmark-rules.js redosEPSS 0.5%CVE-2020-26305HIGHGHSL-2020-291: Regular Expression Denial of Service (ReDoS) in CommonRegexJSEPSS 0.5%CVE-2024-41766HIGHIBM Engineering Lifecycle Optimization - Publishing denial of serviceEPSS 0.5%CVE-2026-77082MEDIUMn8n before 1.123.69 ReDoS via Filter and Switch NodeEPSS 0.5%CVE-2024-58340HIGHLangChain <= 0.3.1 MRKLOutputParser ReDoSEPSS 0.5%CVE-2025-10990HIGHRexml: rexml: denial of service via inefficient regex parsingEPSS 0.5%CVE-2026-0668MEDIUMVisualData extension: Regular Expression Denial of Service (ReDoS) via crafted user inputEPSS 0.5%CVE-2026-52794HIGHSentry: Inefficient Regular Expression Complexity in sentryEPSS 0.5%CVE-2026-76821HIGHOpenCTI: User-Controlled ReDoS in JSON Ingestion MapperEPSS 0.5%CVE-2026-15154MEDIUMGuardrails-detectors: guardrails-detectors: unauthenticated regular-expression denial of service (redos) via detector_params.regexEPSS 0.5%CVE-2025-1194MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.5%CVE-2024-3114MEDIUMUncontrolled Resource Consumption in GitLabEPSS 0.5%CVE-2026-93761HIGHDenial of service via unbounded regex matching in Mongoid's in-memory query matcherEPSS 0.5%CVE-2026-35611HIGHAddressable has a Regular Expression Denial of Service in Addressable templatesEPSS 0.5%CVE-2026-45409MEDIUMInternationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fixEPSS 0.5%