Falhas do tipo CWE-1333

407 resultados

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex que, em certos padrões de entrada, causa backtracking excessivo e consome CPU de forma exponencial. O motor regex tenta múltiplas combinações de correspondência antes de falhar ou suceder, podendo travar a aplicação ou deixá-la lenta demais para responder.

Exemplo

Um validador de email com regex como `(a+)+b` recebe a string `aaaaaaaaaaaaaaaaaaaaX` (sem o caractere final esperado). O motor testa todas as combinações de agrupamento do `a` repetido, levando tempo exponencial em relação ao tamanho da entrada.

Como mitigar

Use bibliotecas de parsing ou validação especializadas em vez de regex complexas (ex: bibliotecas de email ou URL). Se regex for necessária, teste com inputs longos malformados, limpe a entrada antes, ou use engines regex com proteção contra backtracking (como a do Rust).

CVE-2024-6038HIGHReDoS Vulnerability in gaizhenbiao/chuanhuchatgptEPSS 0.7%CVE-2026-67422HIGHpymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processorsEPSS 0.7%CVE-2026-59928HIGHMistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitionsEPSS 0.7%CVE-2024-5552HIGHReDoS in kubeflow/kubeflowEPSS 0.6%CVE-2022-34402MEDIUMDell Wyse ThinOS 2205 contains a Regular Expression Denial of Service Vulnerability in UI. An admin privilege attacker could potentially expEPSS 0.6%CVE-2026-49293HIGHCPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literalsEPSS 0.6%CVE-2026-59925HIGHinline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairsEPSS 0.6%CVE-2026-59922HIGHMistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)EPSS 0.6%CVE-2023-6736MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.6%CVE-2024-25885HIGHAn issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) EPSS 0.6%CVE-2025-5891MEDIUMUnitech pm2 Config.js redosEPSS 0.6%CVE-2026-23897HIGHApollo Server is vulnerable to denial of service with `startStandaloneServer`EPSS 0.6%CVE-2022-1929MEDIUMExponential ReDoS in devcertEPSS 0.6%CVE-2024-50574MEDIUMIn JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionalityEPSS 0.6%CVE-2026-62317HIGHLogto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing)EPSS 0.6%CVE-2026-14895HIGHString::Util versions before 1.36 for Perl are susceptible to a regular expression denial of serviceEPSS 0.6%CVE-2026-49851HIGHMistune: Potential DoS via quadratic-time parsing in parse_link_textEPSS 0.6%CVE-2026-45756HIGHSymfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoSEPSS 0.6%CVE-2026-45133HIGHSymfony: [Yaml] Harden the parser when handling untrusted inputEPSS 0.6%CVE-2025-25285MEDIUM@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic BacktrackingEPSS 0.6%