Weaknesses of type CWE-1333

415 results

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex com padrão mal construído que, em certos inputs, força o engine a testar bilhões de combinações antes de confirmar a rejeição. Isso consome CPU até paralisar o serviço, já que o tempo cresce exponencialmente com o tamanho da entrada.

Example

Uma validação de email como `(a+)+b` aplicada a uma string longa sem 'b' no final faz o engine tentar todas as combinações possíveis de agrupamento de 'a's antes de falhar — um input de 50 caracteres pode levar minutos para processar.

How to mitigate

Use ferramentas como `redos`, `regex-checker` ou testes de desempenho para validar regexes antes do deploy. Para casos simples (email, URL), prefira validadores específicos em vez de regex; se usar regex, limite o tamanho da entrada e adicione timeouts no engine.

CVE-2020-26306HIGHGHSL-2020-296: Regular Expression Denial of Service (ReDoS) in Knwl.jsEPSS 0.5%CVE-2020-26309HIGHGHSL-2020-303: Regular Expression Denial of Service (ReDoS) in nope-validatorEPSS 0.5%CVE-2026-25547CRITICALUncontrolled Resource Consumption in @isaacs/brace-expansionEPSS 0.5%CVE-2026-34939MEDIUMPraisonAI: ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()EPSS 0.4%CVE-2021-4437LOWdbartholomae lambda-middleware frameguard JSON Mime-Type JsonDeserializer.ts redosEPSS 0.4%CVE-2026-0621HIGHMCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoSEPSS 0.4%CVE-2026-42567MEDIUMSvelte: ReDoS in `<svelte:element>` Tag ValidationEPSS 0.4%CVE-2026-22691LOWpypdf has possible long runtimes for malformed startxrefEPSS 0.4%CVE-2026-80206HIGHNLTK 3.10.2 Regular Expression Denial of Service via tgrepEPSS 0.4%CVE-2026-62237MEDIUMGrav < 2.0.4 ReDoS via regex_replace in SandboxEPSS 0.4%CVE-2025-3263MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.4%CVE-2025-3933MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.4%CVE-2025-3264MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.4%CVE-2026-77421MEDIUMJLine: ReDoS in Nano Editor Regex Search ModeEPSS 0.4%CVE-2025-3262MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.4%CVE-2026-35041MEDIUMReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verificationEPSS 0.4%CVE-2025-53539MEDIUMReDoS in fastapi-guard's penetration attempts detectorEPSS 0.4%CVE-2026-6850MEDIUMCrafted message attachment causes client-side denial of service via markdown parser regex backtracking in MattermostEPSS 0.4%CVE-2026-84642HIGHAllowed UNC hostnames for attachments interpreted as a regular expressionEPSS 0.4%CVE-2025-54796HIGHCopyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" pageEPSS 0.4%