Falhas do tipo CWE-1333

484 resultados

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex que, em certos padrões de entrada, causa backtracking excessivo e consome CPU de forma exponencial. O motor regex tenta múltiplas combinações de correspondência antes de falhar ou suceder, podendo travar a aplicação ou deixá-la lenta demais para responder.

Exemplo

Um validador de email com regex como `(a+)+b` recebe a string `aaaaaaaaaaaaaaaaaaaaX` (sem o caractere final esperado). O motor testa todas as combinações de agrupamento do `a` repetido, levando tempo exponencial em relação ao tamanho da entrada.

Como mitigar

Use bibliotecas de parsing ou validação especializadas em vez de regex complexas (ex: bibliotecas de email ou URL). Se regex for necessária, teste com inputs longos malformados, limpe a entrada antes, ou use engines regex com proteção contra backtracking (como a do Rust).

CVE-2023-7279LOWSecure Systems Engineering Connaisseur Delegation Name targets_schema.json redosEPSS 0.5%CVE-2024-27088NONEes5-ext Regular Expression Denial of Service in `function#copy` and `function#toStringTokens`EPSS 0.5%CVE-2020-26303HIGHGHSL-2020-289: Regular Expression Denial of Service (ReDoS) in insaneEPSS 0.5%CVE-2020-26304HIGHGHSL-2020-290: Regular Expression Denial of Service (ReDoS) in foundation-sitesEPSS 0.5%CVE-2025-69873LOWajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enaEPSS 0.5%CVE-2026-25547CRITICALUncontrolled Resource Consumption in @isaacs/brace-expansionEPSS 0.5%CVE-2025-6493MEDIUMCodeMirror Markdown Mode markdown.js redosEPSS 0.5%CVE-2026-112300MEDIUMDiffSK configobj __init__.py _sectionmarker redosEPSS 0.5%CVE-2026-23956HIGHseroval affected by Denial of Service via RegExp serializationEPSS 0.5%CVE-2025-46560MEDIUMvLLM phi4mm: Quadratic Time Complexity in Input Token Processing​ leads to denial of serviceEPSS 0.5%CVE-2026-57584HIGHPhalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoSEPSS 0.5%CVE-2025-0367MEDIUMRegular Expression Denial of Service (ReDoS) in Splunk Supporting Add-on for Active Directory (SA-ldapsearch)EPSS 0.5%CVE-2026-112901MEDIUMPillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutesEPSS 0.5%CVE-2025-6492MEDIUMMarkText index.js getRecommendTitleFromMarkdownString redosEPSS 0.5%CVE-2026-27904HIGHminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressionsEPSS 0.5%CVE-2026-26006MEDIUMRedos (Regular Expression Denial of Service) at Code Extraction Block in significant-gravitas/autogptEPSS 0.5%CVE-2026-83606HIGHxmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructionsEPSS 0.5%CVE-2026-83619HIGHxmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parserEPSS 0.5%CVE-2026-48125MEDIUMUAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`EPSS 0.5%CVE-2026-87819HIGHGitPython before 3.1.60 Denial of Service via ReDoSEPSS 0.5%