Weaknesses of type CWE-1333

415 results

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex com padrão mal construído que, em certos inputs, força o engine a testar bilhões de combinações antes de confirmar a rejeição. Isso consome CPU até paralisar o serviço, já que o tempo cresce exponencialmente com o tamanho da entrada.

Example

Uma validação de email como `(a+)+b` aplicada a uma string longa sem 'b' no final faz o engine tentar todas as combinações possíveis de agrupamento de 'a's antes de falhar — um input de 50 caracteres pode levar minutos para processar.

How to mitigate

Use ferramentas como `redos`, `regex-checker` ou testes de desempenho para validar regexes antes do deploy. Para casos simples (email, URL), prefira validadores específicos em vez de regex; se usar regex, limite o tamanho da entrada e adicione timeouts no engine.

CVE-2025-48058MEDIUMPowSyBl Core contains Polynomial REDoS’esEPSS 0.4%CVE-2025-5890MEDIUMactions toolkit glob internal-pattern.ts globEscape redosEPSS 0.4%CVE-2020-26307HIGHGHSL-2020-301: Regular Expression Denial of Service (ReDoS) in HTML2MarkdownEPSS 0.4%CVE-2020-26310HIGHGHSL-2020-305: Regular Expression Denial of Service (ReDoS) in Pure JavaScript HTML5 ParserEPSS 0.4%CVE-2026-41848LOWSpring Framework Denial of Service via AntPathMatcherEPSS 0.4%CVE-2025-33090HIGHIBM Concert Software denial of serviceEPSS 0.4%CVE-2025-45143HIGHstring-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input.EPSS 0.4%CVE-2025-54363MEDIUMMicrosoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module. extract_full_summary_from_signEPSS 0.4%CVE-2025-5197MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.4%CVE-2025-26042MEDIUMUptime Kuma >== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. If a stEPSS 0.4%CVE-2025-55152MEDIUMoak: ReDoS in x-forwarded-proto and x-forwarded-for headersEPSS 0.4%CVE-2025-2937MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.4%CVE-2026-77423HIGHJLine: ReDoS in Built-in Less Viewer SearchEPSS 0.4%CVE-2025-6051MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.4%CVE-2026-62672MEDIUMGrav: Authenticated ReDoS via regex_replace in Twig SandboxEPSS 0.4%CVE-2026-4923MEDIUMpath-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcardsEPSS 0.4%CVE-2023-27704MEDIUMVoid Tools Everything lower than v1.4.1.1022 was discovered to contain a Regular Expression Denial of Service (ReDoS).EPSS 0.4%CVE-2026-44425MEDIUMShellHub: Crash-DoS via field injection in filter and sort-by parametersEPSS 0.4%CVE-2026-1388HIGHInefficient Regular Expression Complexity in GitLabEPSS 0.4%CVE-2025-2811MEDIUMGL.iNet GL-A1300 Slate Plus API redosEPSS 0.4%