Weaknesses of type CWE-1333

407 results

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex com padrão mal construído que, em certos inputs, força o engine a testar bilhões de combinações antes de confirmar a rejeição. Isso consome CPU até paralisar o serviço, já que o tempo cresce exponencialmente com o tamanho da entrada.

Example

Uma validação de email como `(a+)+b` aplicada a uma string longa sem 'b' no final faz o engine tentar todas as combinações possíveis de agrupamento de 'a's antes de falhar — um input de 50 caracteres pode levar minutos para processar.

How to mitigate

Use ferramentas como `redos`, `regex-checker` ou testes de desempenho para validar regexes antes do deploy. Para casos simples (email, URL), prefira validadores específicos em vez de regex; se usar regex, limite o tamanho da entrada e adicione timeouts no engine.

CVE-2024-10955MEDIUMReDoS (Regular Expression Denial of Service) in gaizhenbiao/chuanhuchatgptEPSS 0.7%CVE-2022-23548MEDIUMDiscourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta16 on the `beta` andEPSS 0.7%CVE-2024-12720MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.7%CVE-2024-12388MEDIUMRegular Expression Denial of Service (ReDoS) in binary-husky/gpt_academicEPSS 0.7%CVE-2018-25049LOWemail-existence index.js redosEPSS 0.7%CVE-2024-46242HIGHAn issue in the validate_email function in CTFd/utils/validators/__init__.py of CTFd 3.7.3 allows attackers to cause a Regular expression DeEPSS 0.7%CVE-2026-28356HIGHReDoS in multipart 1.3.0 - `parse_options_header()`EPSS 0.7%CVE-2020-6817HIGHbleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with anEPSS 0.7%CVE-2025-8262MEDIUMyarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redosEPSS 0.7%CVE-2025-2833MEDIUMzhangyd-c OneBlog HTTP Header redosEPSS 0.7%CVE-2024-7779HIGHReDoS (Regular Expression Denial of Service) in danswer-ai/danswerEPSS 0.7%CVE-2026-44496HIGHAxios: Regular Expression Denial of Service (ReDoS) via Cookie Name InjectionEPSS 0.7%CVE-2026-52746HIGHJSONata: Malicious inputs to "$toMillis" function can cause resource exhaustionEPSS 0.7%CVE-2026-45305HIGHSymfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() RegexEPSS 0.7%CVE-2026-45367HIGHHAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP EndpointEPSS 0.7%CVE-2026-49485HIGHHAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP EndpointEPSS 0.7%CVE-2026-55470HIGHHAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoSEPSS 0.7%CVE-2026-2327MEDIUMVersions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the EPSS 0.7%CVE-2024-2800MEDIUMUncontrolled Resource Consumption in GitLabEPSS 0.7%CVE-2024-45813MEDIUMReDoS vulnerability in multiparametric routes in find-my-wayEPSS 0.7%