Fallos del tipo CWE-1333

484 resultados

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex mal construída que, em casos adversários, força o mecanismo de busca a testar um número exponencial de combinações antes de decidir se há match. Isso consome CPU descontroladamente e pode derrubar a aplicação com um padrão de entrada pequeno e cuidadosamente crafted.

Ejemplo

Um formulário valida email com regex como `(a+)+b`. Se você enviar uma string com muitos 'a's e nenhum 'b' no final, o mecanismo tenta todas as formas possíveis de agrupar aqueles 'a's antes de falhar, gastando segundos ou minutos em uma entrada de 30 caracteres.

Cómo mitigar

Evite quantificadores aninhados (tipo `(x+)+`, `(x*)*`), use âncoras e alternativas específicas, e defina timeouts para execução de regex. Teste com ferramentas como regex101 ou Regex Tester e considere parsing estruturado em vez de regex quando possível.

CVE-2025-2099MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.6%CVE-2025-6069MEDIUMHTMLParser quadratic complexity when processing malformed inputsEPSS 0.6%CVE-2024-54157MEDIUMIn JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detectorEPSS 0.6%CVE-2026-77422HIGHJLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` WrappingEPSS 0.6%CVE-2024-48938HIGHZnuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows DoS/ReDos via email. Parsing the content of emails where HTML code is EPSS 0.6%CVE-2026-33079HIGHMistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titlesEPSS 0.6%CVE-2026-70493MEDIUMOpen WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophicallyEPSS 0.6%CVE-2024-4148HIGHRedos (Regular Expression Denial of Service) in lunary-ai/lunaryEPSS 0.6%CVE-2026-103043HIGHanchorme through 3.0.8 Regular Expression Denial of ServiceEPSS 0.6%CVE-2026-70656MEDIUMCheckmate: Regular Expression Denial of Service (ReDoS) via User-Controlled Regex in Monitor Advanced MatchingEPSS 0.6%CVE-2023-6678MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.6%CVE-2026-47138HIGHParse Server: Pre-authentication denial of service via client version header regex backtrackingEPSS 0.6%CVE-2026-55574HIGHvLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backendsEPSS 0.6%CVE-2026-54268HIGHAngular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)EPSS 0.6%CVE-2026-92599HIGHJoi before 17.13.7 and 18.2.6 ReDoS via isoDateEPSS 0.6%CVE-2026-57577HIGHDotVVM: ReDOS in routingEPSS 0.6%CVE-2026-26996HIGHminimatch has a ReDoS via repeated wildcards with non-matching literal in patternEPSS 0.6%CVE-2025-48059LOWPowSyBl Core Contains a Polynomial ReDoS in RegexCriterionEPSS 0.6%CVE-2024-1495MEDIUMUncontrolled Resource Consumption in GitLabEPSS 0.6%CVE-2024-1963MEDIUMUncontrolled Resource Consumption in GitLabEPSS 0.6%