Fallos del tipo CWE-1333

413 resultados

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex mal construída que, em casos adversários, força o mecanismo de busca a testar um número exponencial de combinações antes de decidir se há match. Isso consome CPU descontroladamente e pode derrubar a aplicação com um padrão de entrada pequeno e cuidadosamente crafted.

Ejemplo

Um formulário valida email com regex como `(a+)+b`. Se você enviar uma string com muitos 'a's e nenhum 'b' no final, o mecanismo tenta todas as formas possíveis de agrupar aqueles 'a's antes de falhar, gastando segundos ou minutos em uma entrada de 30 caracteres.

Cómo mitigar

Evite quantificadores aninhados (tipo `(x+)+`, `(x*)*`), use âncoras e alternativas específicas, e defina timeouts para execução de regex. Teste com ferramentas como regex101 ou Regex Tester e considere parsing estruturado em vez de regex quando possível.

CVE-2025-70030HIGHAn issue pertaining to CWE-1333: Inefficient Regular Expression Complexity (4.19) was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.EPSS 0.3%CVE-2026-58436HIGHParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requestsEPSS 0.3%CVE-2026-8159HIGHmultiparty vulnerable to ReDoS via filename parsingEPSS 0.3%CVE-2025-58451HIGHCattown Vulnerable to Inefficient Regular Expression Complexity and Uncontrolled Resource ConsumptionEPSS 0.3%CVE-2025-66020HIGHValibot has a ReDoS vulnerability in `EMOJI_REGEX`EPSS 0.3%CVE-2026-74039HIGHWazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_contextEPSS 0.3%CVE-2026-70493MEDIUMOpen WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophicallyEPSS 0.3%CVE-2024-28864LOW[TagAwareCipher] - Decryption Failure (Regex Match)EPSS 0.3%CVE-2026-26936MEDIUMInefficient Regular Expression Complexity in Kibana Leading to Denial of ServiceEPSS 0.3%CVE-2026-86081HIGHn8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone PathEPSS 0.3%CVE-2025-24026MEDIUMiTop Inefficient Regular Expression Complexity vulnerabilityEPSS 0.3%CVE-2026-41848LOWSpring Framework Denial of Service via AntPathMatcherEPSS 0.3%CVE-2026-73556MEDIUMvLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574EPSS 0.3%CVE-2026-44796MEDIUMNautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)EPSS 0.3%CVE-2026-22178MEDIUMOpenClaw < 2026.2.19 - ReDoS and Regex Injection via Unescaped Feishu Mention MetadataEPSS 0.3%CVE-2026-10692MEDIUMjohnhuang316 code-index-mcp search_code_advanced is_safe_regex_pattern redosEPSS 0.3%CVE-2025-43764MEDIUMSelf-ReDoS (Regular expression Denial of Service) exists with Role Name search field of Kaleo Designer portlet JavaScript in Liferay Portal EPSS 0.3%CVE-2026-21868HIGHFlag Forge has ReDoS Vulnerability in User Profile Lookup APIEPSS 0.3%CVE-2024-58379MEDIUMnodemailer before 6.9.9 ReDoS via attachDataUrls parameterEPSS 0.3%CVE-2026-83606HIGHxmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructionsEPSS 0.3%