Fallos del tipo CWE-1333

407 resultados

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex mal construída que, em casos adversários, força o mecanismo de busca a testar um número exponencial de combinações antes de decidir se há match. Isso consome CPU descontroladamente e pode derrubar a aplicação com um padrão de entrada pequeno e cuidadosamente crafted.

Ejemplo

Um formulário valida email com regex como `(a+)+b`. Se você enviar uma string com muitos 'a's e nenhum 'b' no final, o mecanismo tenta todas as formas possíveis de agrupar aqueles 'a's antes de falhar, gastando segundos ou minutos em uma entrada de 30 caracteres.

Cómo mitigar

Evite quantificadores aninhados (tipo `(x+)+`, `(x*)*`), use âncoras e alternativas específicas, e defina timeouts para execução de regex. Teste com ferramentas como regex101 ou Regex Tester e considere parsing estruturado em vez de regex quando possível.

CVE-2025-6069MEDIUMHTMLParser quadratic complexity when processing malformed inputsEPSS 0.6%CVE-2022-34428MEDIUMDell Hybrid Client prior to version 1.8 contains a Regular Expression Denial of Service Vulnerability in the UI. An adversary with WMS groupEPSS 0.6%CVE-2023-6678MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.6%CVE-2018-25110MEDIUMRegular Expression Denial of Service (ReDoS) in markedjs/markedEPSS 0.6%CVE-2026-47138HIGHParse Server: Pre-authentication denial of service via client version header regex backtrackingEPSS 0.6%CVE-2026-55574HIGHvLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backendsEPSS 0.6%CVE-2026-54268HIGHAngular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)EPSS 0.6%CVE-2025-2099MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.6%CVE-2026-68497HIGHjackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of serviceEPSS 0.6%CVE-2025-7074MEDIUMvercel hyper rimraf-standalone.js ignoreMap redosEPSS 0.6%CVE-2024-1495MEDIUMUncontrolled Resource Consumption in GitLabEPSS 0.6%CVE-2024-1963MEDIUMUncontrolled Resource Consumption in GitLabEPSS 0.6%CVE-2024-1736MEDIUMUncontrolled Resource Consumption in GitLabEPSS 0.6%CVE-2025-48059LOWPowSyBl Core Contains a Polynomial ReDoS in RegexCriterionEPSS 0.6%CVE-2026-59220MEDIUMOpen WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default configEPSS 0.6%CVE-2025-5889LOWjuliangruber brace-expansion index.js expand redosEPSS 0.6%CVE-2023-25167MEDIUMRegular expression denial of service via installing themes via git in discourseEPSS 0.6%CVE-2026-52778CRITICALYesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)EPSS 0.6%CVE-2025-68475HIGHFedify has ReDoS Vulnerability in HTML Parsing RegexEPSS 0.6%CVE-2024-1892HIGHReDoS Vulnerability in scrapy/scrapy's XMLFeedSpiderEPSS 0.6%