Fallos del tipo CWE-1333

484 resultados

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex mal construída que, em casos adversários, força o mecanismo de busca a testar um número exponencial de combinações antes de decidir se há match. Isso consome CPU descontroladamente e pode derrubar a aplicação com um padrão de entrada pequeno e cuidadosamente crafted.

Ejemplo

Um formulário valida email com regex como `(a+)+b`. Se você enviar uma string com muitos 'a's e nenhum 'b' no final, o mecanismo tenta todas as formas possíveis de agrupar aqueles 'a's antes de falhar, gastando segundos ou minutos em uma entrada de 30 caracteres.

Cómo mitigar

Evite quantificadores aninhados (tipo `(x+)+`, `(x*)*`), use âncoras e alternativas específicas, e defina timeouts para execução de regex. Teste com ferramentas como regex101 ou Regex Tester e considere parsing estruturado em vez de regex quando possível.

CVE-2022-36034HIGHPossible Regular Expression Denial of Service (ReDoS) used on uncontrolled data in nitrado.jsEPSS 0.9%CVE-2019-25103MEDIUMsimple-markdown simple-markdown.js redosEPSS 0.9%CVE-2024-47889MEDIUMAction Mailer has possible ReDoS vulnerability in block_formatEPSS 0.9%CVE-2024-45296HIGHpath-to-regexp outputs backtracking regular expressionsEPSS 0.9%CVE-2023-4316HIGHZod 3.22.2 - Regular expression Denial of ServiceEPSS 0.9%CVE-2018-25077LOWmelnaron mel-spintax spintax.js redosEPSS 0.9%CVE-2025-4727MEDIUMMeteor livedata_server.js Object.assign redosEPSS 0.9%CVE-2020-36661LOWKong lua-multipart multipart.lua is_header redosEPSS 0.9%CVE-2023-33950MEDIUMPattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are EPSS 0.9%CVE-2023-0632MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.9%CVE-2022-1930MEDIUMReDoS in eth-account encode_structured_data functionEPSS 0.9%CVE-2023-3424HIGHInefficient Regular Expression Complexity in GitLabEPSS 0.9%CVE-2024-45801HIGHTampering by prototype polution in DOMPurifyEPSS 0.9%CVE-2022-3514MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before EPSS 0.9%CVE-2023-23621HIGHDiscourse vulnerable to ReDoS in user agent parsingEPSS 0.9%CVE-2024-21538HIGHVersions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS)EPSS 0.9%CVE-2022-4131MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 15.5.7, all versions starting from 15.6 beforeEPSS 0.9%CVE-2024-39316MEDIUMRack ReDoS Vulnerability in HTTP Accept Headers ParsingEPSS 0.9%CVE-2023-3205MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.8%CVE-2025-8262MEDIUMyarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redosEPSS 0.8%