Fallos del tipo CWE-1333

484 resultados

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex mal construída que, em casos adversários, força o mecanismo de busca a testar um número exponencial de combinações antes de decidir se há match. Isso consome CPU descontroladamente e pode derrubar a aplicação com um padrão de entrada pequeno e cuidadosamente crafted.

Ejemplo

Um formulário valida email com regex como `(a+)+b`. Se você enviar uma string com muitos 'a's e nenhum 'b' no final, o mecanismo tenta todas as formas possíveis de agrupar aqueles 'a's antes de falhar, gastando segundos ou minutos em uma entrada de 30 caracteres.

Cómo mitigar

Evite quantificadores aninhados (tipo `(x+)+`, `(x*)*`), use âncoras e alternativas específicas, e defina timeouts para execução de regex. Teste com ferramentas como regex101 ou Regex Tester e considere parsing estruturado em vez de regex quando possível.

CVE-2025-25283HIGHparse-duraton vulnerable to Regex Denial of Service that results in event loop delay and out of memoryEPSS 0.8%CVE-2024-4056HIGHDenial of service condition in M-Files ServerEPSS 0.8%CVE-2024-23732HIGHThe JSON loader in Embedchain before 0.1.57 allows a ReDoS (regular expression denial of service) via a long string to json.py.EPSS 0.8%CVE-2026-82617CRITICALApache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patternsEPSS 0.8%CVE-2024-41655HIGHTF2 Item Format Regular Expression Denial of Service vulnerabilityEPSS 0.8%CVE-2025-27220MEDIUMIn the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.EPSS 0.8%CVE-2023-6688MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.8%CVE-2023-6682MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.8%CVE-2024-46242HIGHAn issue in the validate_email function in CTFd/utils/validators/__init__.py of CTFd 3.7.3 allows attackers to cause a Regular expression DeEPSS 0.8%CVE-2024-12720MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.7%CVE-2024-12388MEDIUMRegular Expression Denial of Service (ReDoS) in binary-husky/gpt_academicEPSS 0.7%CVE-2024-10955MEDIUMReDoS (Regular Expression Denial of Service) in gaizhenbiao/chuanhuchatgptEPSS 0.7%CVE-2026-62317HIGHLogto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing)EPSS 0.7%CVE-2026-72818HIGHNLTK TweetTokenizer URL Pattern Backtracks Catastrophically on Naked-Domain-Like InputEPSS 0.7%CVE-2025-61581HIGHApache Traffic Control: ReDoS issue in Traffic Router configurationEPSS 0.7%CVE-2025-2833MEDIUMzhangyd-c OneBlog HTTP Header redosEPSS 0.7%CVE-2026-2327MEDIUMVersions of the package markdown-it from 13.0.0 and before 14.1.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the EPSS 0.7%CVE-2023-3909MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.7%CVE-2026-92114MEDIUMa2ui-project a2ui Basic Catalog safe_regex.ts redosEPSS 0.7%CVE-2022-34402MEDIUMDell Wyse ThinOS 2205 contains a Regular Expression Denial of Service Vulnerability in UI. An admin privilege attacker could potentially expEPSS 0.7%