CVE-2026-57577highCWE-1333

CVE-2026-57577: falha de alta gravidade em riganti dotvvm

DotVVM: ReDOS in routing

Publicada em

Seguir esta CVE+ Monitorar dotvvm

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.2epss 0.6%
DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
riganti · dotvvm
CVEs relacionadas — riganti dotvvm

No mesmo produto, das mais perigosas para as menos.

CVE-2026-57578CRITICALDotVVM: Missing authorization in AuthorizeActionFilterEPSS 0.6%CVE-2026-57581MEDIUMDotVVM: Unrestricted file uploadEPSS 0.6%