Falhas do tipo CWE-1333

366 resultados

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex que, em certos padrões de entrada, causa backtracking excessivo e consome CPU de forma exponencial. O motor regex tenta múltiplas combinações de correspondência antes de falhar ou suceder, podendo travar a aplicação ou deixá-la lenta demais para responder.

Exemplo

Um validador de email com regex como `(a+)+b` recebe a string `aaaaaaaaaaaaaaaaaaaaX` (sem o caractere final esperado). O motor testa todas as combinações de agrupamento do `a` repetido, levando tempo exponencial em relação ao tamanho da entrada.

Como mitigar

Use bibliotecas de parsing ou validação especializadas em vez de regex complexas (ex: bibliotecas de email ou URL). Se regex for necessária, teste com inputs longos malformados, limpe a entrada antes, ou use engines regex com proteção contra backtracking (como a do Rust).

CVE-2023-3364HIGHInefficient Regular Expression Complexity in GitLabEPSS 44.5%CVE-2024-8124HIGHInefficient Regular Expression Complexity in GitLabEPSS 40.0%CVE-2024-25126MEDIUMRack ReDos in content type parsing (2nd degree polynomial)EPSS 35.4%CVE-2024-2651MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 33.3%CVE-2021-32837HIGHmechanize vulnerable to ReDoSEPSS 28.9%CVE-2024-2829HIGHInefficient Regular Expression Complexity in GitLabEPSS 26.0%CVE-2021-3749HIGHInefficient Regular Expression Complexity in axios/axiosEPSS 8.5%CVE-2015-8315HIGHThe ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "reEPSS 6.8%CVE-2021-3807HIGHInefficient Regular Expression Complexity in chalk/ansi-regexEPSS 3.6%CVE-2022-24836HIGHInefficient Regular Expression Complexity in NokogiriEPSS 3.5%CVE-2023-36053HIGHIn Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regulaEPSS 3.0%CVE-2022-41323HIGHIn Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service atEPSS 2.8%CVE-2022-21680HIGHCubic catastrophic backtracking (ReDoS) in markedEPSS 2.8%CVE-2022-25883MEDIUMVersions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when EPSS 2.8%CVE-2022-21681HIGHExponential catastrophic backtracking (ReDoS) in markedEPSS 2.7%CVE-2023-28755MEDIUMA ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have speEPSS 2.6%CVE-2022-40897MEDIUMPython Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted packagEPSS 2.6%CVE-2022-26650—Apache ShenYu (incubating) Regular expression denial of serviceEPSS 2.6%CVE-2024-6232HIGHRegular-expression DoS when parsing TarFile headersEPSS 2.2%CVE-2021-3803HIGHInefficient Regular Expression Complexity in fb55/nth-checkEPSS 2.2%