Fallos del tipo CWE-1333

407 resultados

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex mal construída que, em casos adversários, força o mecanismo de busca a testar um número exponencial de combinações antes de decidir se há match. Isso consome CPU descontroladamente e pode derrubar a aplicação com um padrão de entrada pequeno e cuidadosamente crafted.

Ejemplo

Um formulário valida email com regex como `(a+)+b`. Se você enviar uma string com muitos 'a's e nenhum 'b' no final, o mecanismo tenta todas as formas possíveis de agrupar aqueles 'a's antes de falhar, gastando segundos ou minutos em uma entrada de 30 caracteres.

Cómo mitigar

Evite quantificadores aninhados (tipo `(x+)+`, `(x*)*`), use âncoras e alternativas específicas, e defina timeouts para execução de regex. Teste com ferramentas como regex101 ou Regex Tester e considere parsing estruturado em vez de regex quando possível.

CVE-2025-27789MEDIUMInefficient RexExp complexity in generated code with .replace when transpiling named capturing groupsEPSS 0.6%CVE-2026-58578HIGHLobeChat < 2.2.10-canary.15 - Regular Expression Denial of Service in GitHub Skill ImportEPSS 0.5%CVE-2026-23956HIGHseroval affected by Denial of Service via RegExp serializationEPSS 0.5%CVE-2023-23925HIGHSwitcher Client contains Regular Expression Denial of Service (ReDoS)EPSS 0.5%CVE-2020-26304HIGHGHSL-2020-290: Regular Expression Denial of Service (ReDoS) in foundation-sitesEPSS 0.5%CVE-2020-26303HIGHGHSL-2020-289: Regular Expression Denial of Service (ReDoS) in insaneEPSS 0.5%CVE-2024-4025MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.5%CVE-2026-92114MEDIUMa2ui-project a2ui Basic Catalog safe_regex.ts redosEPSS 0.5%CVE-2026-71190HIGHIn OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtrackiEPSS 0.5%CVE-2023-7279LOWSecure Systems Engineering Connaisseur Delegation Name targets_schema.json redosEPSS 0.5%CVE-2024-27088NONEes5-ext Regular Expression Denial of Service in `function#copy` and `function#toStringTokens`EPSS 0.5%CVE-2025-6638MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.5%CVE-2026-33079HIGHMistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titlesEPSS 0.5%CVE-2026-26996HIGHminimatch has a ReDoS via repeated wildcards with non-matching literal in patternEPSS 0.5%CVE-2024-9506LOWRegular Expression Denial of Service (ReDoS)EPSS 0.5%CVE-2024-36751MEDIUMAn issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL.EPSS 0.5%CVE-2026-57584HIGHPhalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoSEPSS 0.5%CVE-2026-49477HIGHSoup Sieve: Regular Expression Denial of Service (ReDoS) in soupsieve Selector ParserEPSS 0.5%CVE-2020-26311HIGHGHSL-2020-312: Regular Expression Denial of Service (ReDoS) in useragentEPSS 0.5%CVE-2020-26308HIGHGHSL-2020-302: Regular Expression Denial of Service (ReDoS) in validate.jsEPSS 0.5%