Falhas do tipo CWE-1333

407 resultados

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex que, em certos padrões de entrada, causa backtracking excessivo e consome CPU de forma exponencial. O motor regex tenta múltiplas combinações de correspondência antes de falhar ou suceder, podendo travar a aplicação ou deixá-la lenta demais para responder.

Exemplo

Um validador de email com regex como `(a+)+b` recebe a string `aaaaaaaaaaaaaaaaaaaaX` (sem o caractere final esperado). O motor testa todas as combinações de agrupamento do `a` repetido, levando tempo exponencial em relação ao tamanho da entrada.

Como mitigar

Use bibliotecas de parsing ou validação especializadas em vez de regex complexas (ex: bibliotecas de email ou URL). Se regex for necessária, teste com inputs longos malformados, limpe a entrada antes, ou use engines regex com proteção contra backtracking (como a do Rust).

CVE-2022-34428MEDIUMDell Hybrid Client prior to version 1.8 contains a Regular Expression Denial of Service Vulnerability in the UI. An adversary with WMS groupEPSS 0.6%CVE-2025-6069MEDIUMHTMLParser quadratic complexity when processing malformed inputsEPSS 0.6%CVE-2023-6678MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.6%CVE-2018-25110MEDIUMRegular Expression Denial of Service (ReDoS) in markedjs/markedEPSS 0.6%CVE-2026-47138HIGHParse Server: Pre-authentication denial of service via client version header regex backtrackingEPSS 0.6%CVE-2026-55574HIGHvLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backendsEPSS 0.6%CVE-2026-54268HIGHAngular: Denial of Service (DoS) via OOM in Date Formatting (formatDate)EPSS 0.6%CVE-2025-2099MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.6%CVE-2026-68497HIGHjackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of serviceEPSS 0.6%CVE-2025-7074MEDIUMvercel hyper rimraf-standalone.js ignoreMap redosEPSS 0.6%CVE-2024-1963MEDIUMUncontrolled Resource Consumption in GitLabEPSS 0.6%CVE-2024-1736MEDIUMUncontrolled Resource Consumption in GitLabEPSS 0.6%CVE-2025-48059LOWPowSyBl Core Contains a Polynomial ReDoS in RegexCriterionEPSS 0.6%CVE-2024-1495MEDIUMUncontrolled Resource Consumption in GitLabEPSS 0.6%CVE-2026-59220MEDIUMOpen WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default configEPSS 0.6%CVE-2025-5889LOWjuliangruber brace-expansion index.js expand redosEPSS 0.6%CVE-2023-25167MEDIUMRegular expression denial of service via installing themes via git in discourseEPSS 0.6%CVE-2026-52778CRITICALYesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)EPSS 0.6%CVE-2025-68475HIGHFedify has ReDoS Vulnerability in HTML Parsing RegexEPSS 0.6%CVE-2024-1892HIGHReDoS Vulnerability in scrapy/scrapy's XMLFeedSpiderEPSS 0.6%