Weaknesses of type CWE-1333

415 results

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex com padrão mal construído que, em certos inputs, força o engine a testar bilhões de combinações antes de confirmar a rejeição. Isso consome CPU até paralisar o serviço, já que o tempo cresce exponencialmente com o tamanho da entrada.

Example

Uma validação de email como `(a+)+b` aplicada a uma string longa sem 'b' no final faz o engine tentar todas as combinações possíveis de agrupamento de 'a's antes de falhar — um input de 50 caracteres pode levar minutos para processar.

How to mitigate

Use ferramentas como `redos`, `regex-checker` ou testes de desempenho para validar regexes antes do deploy. Para casos simples (email, URL), prefira validadores específicos em vez de regex; se usar regex, limite o tamanho da entrada e adicione timeouts no engine.

CVE-2025-54364MEDIUMMicrosoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module. option_descriptions employs anEPSS 0.4%CVE-2026-10291MEDIUMEnderfga claw-orchestrator Session Grep Endpoint embedded-server.ts validateRegex redosEPSS 0.4%CVE-2026-10691MEDIUMwonderwhy-er DesktopCommanderMCP start_search search-manager.ts redosEPSS 0.4%CVE-2026-58270MEDIUMSync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`EPSS 0.3%CVE-2025-7579MEDIUMchinese-poetry server.js redosEPSS 0.3%CVE-2025-70034HIGHAn issue pertaining to CWE-1333: Inefficient Regular Expression Complexity (4.19) was discovered in mscdex ssh2 v1.17.0.EPSS 0.3%CVE-2025-70030HIGHAn issue pertaining to CWE-1333: Inefficient Regular Expression Complexity (4.19) was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.EPSS 0.3%CVE-2026-59893HIGHsqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)EPSS 0.3%CVE-2025-58451HIGHCattown Vulnerable to Inefficient Regular Expression Complexity and Uncontrolled Resource ConsumptionEPSS 0.3%CVE-2026-54284HIGHsqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps triggerEPSS 0.3%CVE-2025-66020HIGHValibot has a ReDoS vulnerability in `EMOJI_REGEX`EPSS 0.3%CVE-2026-66074MEDIUMRabbitMQ: ReDoS via management API ?name= filterEPSS 0.3%CVE-2024-28864LOW[TagAwareCipher] - Decryption Failure (Regex Match)EPSS 0.3%CVE-2025-24026MEDIUMiTop Inefficient Regular Expression Complexity vulnerabilityEPSS 0.3%CVE-2026-72912MEDIUMCyberChef’s pretty-recipe parser vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URLEPSS 0.3%CVE-2026-22178MEDIUMOpenClaw < 2026.2.19 - ReDoS and Regex Injection via Unescaped Feishu Mention MetadataEPSS 0.3%CVE-2026-10692MEDIUMjohnhuang316 code-index-mcp search_code_advanced is_safe_regex_pattern redosEPSS 0.3%CVE-2025-43764MEDIUMSelf-ReDoS (Regular expression Denial of Service) exists with Role Name search field of Kaleo Designer portlet JavaScript in Liferay Portal EPSS 0.3%CVE-2026-21868HIGHFlag Forge has ReDoS Vulnerability in User Profile Lookup APIEPSS 0.3%CVE-2024-58379MEDIUMnodemailer before 6.9.9 ReDoS via attachDataUrls parameterEPSS 0.3%