Fallos del tipo CWE-1333

484 resultados

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex mal construída que, em casos adversários, força o mecanismo de busca a testar um número exponencial de combinações antes de decidir se há match. Isso consome CPU descontroladamente e pode derrubar a aplicação com um padrão de entrada pequeno e cuidadosamente crafted.

Ejemplo

Um formulário valida email com regex como `(a+)+b`. Se você enviar uma string com muitos 'a's e nenhum 'b' no final, o mecanismo tenta todas as formas possíveis de agrupar aqueles 'a's antes de falhar, gastando segundos ou minutos em uma entrada de 30 caracteres.

Cómo mitigar

Evite quantificadores aninhados (tipo `(x+)+`, `(x*)*`), use âncoras e alternativas específicas, e defina timeouts para execução de regex. Teste com ferramentas como regex101 ou Regex Tester e considere parsing estruturado em vez de regex quando possível.

CVE-2024-1736MEDIUMUncontrolled Resource Consumption in GitLabEPSS 0.6%CVE-2026-59220MEDIUMOpen WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default configEPSS 0.6%CVE-2026-70489MEDIUMOpen WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsingEPSS 0.6%CVE-2024-9506LOWRegular Expression Denial of Service (ReDoS)EPSS 0.6%CVE-2023-25167MEDIUMRegular expression denial of service via installing themes via git in discourseEPSS 0.6%CVE-2025-27789MEDIUMInefficient RexExp complexity in generated code with .replace when transpiling named capturing groupsEPSS 0.6%CVE-2026-86081HIGHn8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone PathEPSS 0.6%CVE-2025-68475HIGHFedify has ReDoS Vulnerability in HTML Parsing RegexEPSS 0.6%CVE-2026-118779HIGHForge: Regular expression denial of service in PEM decoding (pem.decode)EPSS 0.6%CVE-2026-74039HIGHWazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_contextEPSS 0.6%CVE-2025-6638MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.6%CVE-2024-4025MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.6%CVE-2024-1892HIGHReDoS Vulnerability in scrapy/scrapy's XMLFeedSpiderEPSS 0.6%CVE-2025-10990HIGHRexml: rexml: denial of service via inefficient regex parsingEPSS 0.5%CVE-2026-58578HIGHLobeChat < 2.2.10-canary.15 - Regular Expression Denial of Service in GitHub Skill ImportEPSS 0.5%CVE-2026-52794HIGHSentry: Inefficient Regular Expression Complexity in sentryEPSS 0.5%CVE-2026-30837HIGHElysia has a string URL format redosEPSS 0.5%CVE-2024-36751MEDIUMAn issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL.EPSS 0.5%CVE-2025-48887MEDIUMvLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py`EPSS 0.5%CVE-2023-23925HIGHSwitcher Client contains Regular Expression Denial of Service (ReDoS)EPSS 0.5%