Falhas do tipo CWE-1333

484 resultados

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex que, em certos padrões de entrada, causa backtracking excessivo e consome CPU de forma exponencial. O motor regex tenta múltiplas combinações de correspondência antes de falhar ou suceder, podendo travar a aplicação ou deixá-la lenta demais para responder.

Exemplo

Um validador de email com regex como `(a+)+b` recebe a string `aaaaaaaaaaaaaaaaaaaaX` (sem o caractere final esperado). O motor testa todas as combinações de agrupamento do `a` repetido, levando tempo exponencial em relação ao tamanho da entrada.

Como mitigar

Use bibliotecas de parsing ou validação especializadas em vez de regex complexas (ex: bibliotecas de email ou URL). Se regex for necessária, teste com inputs longos malformados, limpe a entrada antes, ou use engines regex com proteção contra backtracking (como a do Rust).

CVE-2026-14741HIGHHTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_dateEPSS 0.6%CVE-2026-45133HIGHSymfony: [Yaml] Harden the parser when handling untrusted inputEPSS 0.6%CVE-2025-25288MEDIUM@octokit/plugin-paginate-rest has a Regular Expression in iterator that Leads to ReDoS Vulnerability Due to Catastrophic BacktrackingEPSS 0.6%CVE-2025-25289MEDIUM@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic BacktrackingEPSS 0.6%CVE-2026-68497HIGHjackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of serviceEPSS 0.6%CVE-2026-89407HIGHjackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoSEPSS 0.6%CVE-2025-25285MEDIUM@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic BacktrackingEPSS 0.6%CVE-2026-24001LOWjsdiff has a Denial of Service vulnerability in parsePatch and applyPatchEPSS 0.6%CVE-2023-25166MEDIUMRegular Expression Denial of Service (ReDoS) VulnerabilityEPSS 0.6%CVE-2025-5889LOWjuliangruber brace-expansion index.js expand redosEPSS 0.6%CVE-2024-39317MEDIUMWagtail regular expression denial-of-service via search query parsingEPSS 0.6%CVE-2024-28865HIGHdjango-wiki denial of service via regular expressionEPSS 0.6%CVE-2018-25110MEDIUMRegular Expression Denial of Service (ReDoS) in markedjs/markedEPSS 0.6%CVE-2026-69207MEDIUMHono: ReDoS in CORS middleware via Access-Control-Request-HeadersEPSS 0.6%CVE-2026-85999MEDIUMSoup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)EPSS 0.6%CVE-2026-63460HIGHVendure: Unauthenticated ReDoS via `regex` filter on SQLite backendsEPSS 0.6%CVE-2026-86000MEDIUMSoup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patternsEPSS 0.6%CVE-2026-58436HIGHParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requestsEPSS 0.6%CVE-2025-2099MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.6%CVE-2026-67422HIGHpymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processorsEPSS 0.6%