Weaknesses of type CWE-1333

415 results

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex com padrão mal construído que, em certos inputs, força o engine a testar bilhões de combinações antes de confirmar a rejeição. Isso consome CPU até paralisar o serviço, já que o tempo cresce exponencialmente com o tamanho da entrada.

Example

Uma validação de email como `(a+)+b` aplicada a uma string longa sem 'b' no final faz o engine tentar todas as combinações possíveis de agrupamento de 'a's antes de falhar — um input de 50 caracteres pode levar minutos para processar.

How to mitigate

Use ferramentas como `redos`, `regex-checker` ou testes de desempenho para validar regexes antes do deploy. Para casos simples (email, URL), prefira validadores específicos em vez de regex; se usar regex, limite o tamanho da entrada e adicione timeouts no engine.

CVE-2023-3210MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.8%CVE-2024-8763HIGHRegular Expression Denial of Service (ReDoS) in lunary-ai/lunaryEPSS 0.8%CVE-2024-8764HIGHImproper Authorization in lunary-ai/lunaryEPSS 0.8%CVE-2024-8789HIGHRegular Expression Denial of Service (ReDoS) in lunary-ai/lunaryEPSS 0.8%CVE-2023-45813MEDIUMInefficient Regular Expression Complexity in TorBotEPSS 0.8%CVE-2020-36830MEDIUMnescalante urlregex Backtracking index.js redosEPSS 0.8%CVE-2024-8998HIGHRegular Expression Denial of Service (ReDoS) in lunary-ai/lunaryEPSS 0.8%CVE-2026-4926HIGHpath-to-regexp vulnerable to Denial of Service via sequential optional groupsEPSS 0.8%CVE-2024-52798HIGHpath-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.xEPSS 0.8%CVE-2025-25290MEDIUM@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic BacktrackingEPSS 0.8%CVE-2024-23732HIGHThe JSON loader in Embedchain before 0.1.57 allows a ReDoS (regular expression denial of service) via a long string to json.py.EPSS 0.8%CVE-2025-25283HIGHparse-duraton vulnerable to Regex Denial of Service that results in event loop delay and out of memoryEPSS 0.8%CVE-2024-4056HIGHDenial of service condition in M-Files ServerEPSS 0.8%CVE-2024-41655HIGHTF2 Item Format Regular Expression Denial of Service vulnerabilityEPSS 0.8%CVE-2023-4316HIGHZod 3.22.2 - Regular expression Denial of ServiceEPSS 0.8%CVE-2023-6688MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.8%CVE-2023-6682MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.8%CVE-2025-27220MEDIUMIn the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.EPSS 0.7%CVE-2025-4215LOWgorhill uBlock Origin UI 1p-filters.js currentStateChanged redosEPSS 0.7%CVE-2025-61581HIGHApache Traffic Control: ReDoS issue in Traffic Router configurationEPSS 0.7%