Fallos del tipo CWE-1333

413 resultados

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex mal construída que, em casos adversários, força o mecanismo de busca a testar um número exponencial de combinações antes de decidir se há match. Isso consome CPU descontroladamente e pode derrubar a aplicação com um padrão de entrada pequeno e cuidadosamente crafted.

Ejemplo

Um formulário valida email com regex como `(a+)+b`. Se você enviar uma string com muitos 'a's e nenhum 'b' no final, o mecanismo tenta todas as formas possíveis de agrupar aqueles 'a's antes de falhar, gastando segundos ou minutos em uma entrada de 30 caracteres.

Cómo mitigar

Evite quantificadores aninhados (tipo `(x+)+`, `(x*)*`), use âncoras e alternativas específicas, e defina timeouts para execução de regex. Teste com ferramentas como regex101 ou Regex Tester e considere parsing estruturado em vez de regex quando possível.

CVE-2026-83606HIGHxmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructionsEPSS 0.3%CVE-2025-62484HIGHZoom Workplace Clients - Inefficient Regular Expression ComplexityEPSS 0.3%CVE-2026-87819HIGHGitPython before 3.1.60 Denial of Service via ReDoSEPSS 0.3%CVE-2025-43880MEDIUMInefficient regular expression complexity issue exists in GROWI prior to v7.1.6. If exploited, a logged-in user may cause a denial of servicEPSS 0.3%CVE-2026-66062MEDIUMSvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept headerEPSS 0.3%CVE-2026-85062MEDIUMColord: Slow rejection of oversized malformed color stringsEPSS 0.3%CVE-2026-66766HIGHDenial of Service (DoS) in SAP S/4HANA (Manage Supply Protection)EPSS 0.3%CVE-2026-58270MEDIUMSync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`EPSS 0.3%CVE-2026-59893HIGHsqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)EPSS 0.3%CVE-2026-79770HIGHNokogiri before 1.19.3 ReDoS via CSS selector tokenizerEPSS 0.3%CVE-2026-77082MEDIUMn8n before 1.123.69 ReDoS via Filter and Switch NodeEPSS 0.3%CVE-2026-93761HIGHDenial of service via unbounded regex matching in Mongoid's in-memory query matcherEPSS 0.3%CVE-2026-80206HIGHNLTK 3.10.2 Regular Expression Denial of Service via tgrepEPSS 0.3%CVE-2026-54284HIGHsqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps triggerEPSS 0.3%CVE-2026-35041MEDIUMReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verificationEPSS 0.3%CVE-2026-84642HIGHAllowed UNC hostnames for attachments interpreted as a regular expressionEPSS 0.3%CVE-2026-44425MEDIUMShellHub: Crash-DoS via field injection in filter and sort-by parametersEPSS 0.3%CVE-2026-0967LOWLibssh: libssh: denial of service via inefficient regular expression processingEPSS 0.2%CVE-2026-3293MEDIUMsnowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redosEPSS 0.2%CVE-2025-9308MEDIUMyarnpkg Yarn request-manager.js setOptions redosEPSS 0.2%