Weaknesses of type CWE-1333

484 results

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex com padrão mal construído que, em certos inputs, força o engine a testar bilhões de combinações antes de confirmar a rejeição. Isso consome CPU até paralisar o serviço, já que o tempo cresce exponencialmente com o tamanho da entrada.

Example

Uma validação de email como `(a+)+b` aplicada a uma string longa sem 'b' no final faz o engine tentar todas as combinações possíveis de agrupamento de 'a's antes de falhar — um input de 50 caracteres pode levar minutos para processar.

How to mitigate

Use ferramentas como `redos`, `regex-checker` ou testes de desempenho para validar regexes antes do deploy. Para casos simples (email, URL), prefira validadores específicos em vez de regex; se usar regex, limite o tamanho da entrada e adicione timeouts no engine.

CVE-2023-26116MEDIUMVersions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility fuEPSS 1.7%CVE-2023-26117MEDIUMVersions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to tEPSS 1.7%CVE-2023-26118MEDIUMVersions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> elementEPSS 1.7%CVE-2023-39174MEDIUMIn JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackersEPSS 1.7%CVE-2022-24373MEDIUMRegular Expression Denial of Service (ReDoS)EPSS 1.6%CVE-2022-25918MEDIUMRegular Expression Denial of Service (ReDoS)EPSS 1.6%CVE-2022-25881MEDIUMThis affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent EPSS 1.6%CVE-2021-3828HIGHInefficient Regular Expression Complexity in nltk/nltkEPSS 1.6%CVE-2022-25901MEDIUMVersions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function,EPSS 1.6%CVE-2022-23517HIGHInefficient Regular Expression Complexity in rails-html-sanitizerEPSS 1.6%CVE-2021-3842HIGHInefficient Regular Expression Complexity in nltk/nltkEPSS 1.6%CVE-2021-43307MEDIUMExponential ReDoS in semver-regexEPSS 1.6%CVE-2023-36543—Apache Airflow: ReDoS via dags functionEPSS 1.6%CVE-2021-43306MEDIUMExponential ReDoS in jquery-validationEPSS 1.5%CVE-2021-3795HIGHInefficient Regular Expression Complexity in sindresorhus/semver-regexEPSS 1.5%CVE-2024-26142HIGHRails possible ReDoS vulnerability in Accept header parsing in Action DispatchEPSS 1.5%CVE-2022-36064MEDIUMShescape Inefficient Regular Expression Complexity vulnerabilityEPSS 1.5%CVE-2021-43805HIGHReDos vulnerability on guest checkout email validationEPSS 1.4%CVE-2024-4067MEDIUMRegular Expression Denial of Service in micromatchEPSS 1.4%CVE-2020-36649LOWmholt PapaParse papaparse.js redosEPSS 1.4%