Falhas do tipo CWE-1333

484 resultados

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex que, em certos padrões de entrada, causa backtracking excessivo e consome CPU de forma exponencial. O motor regex tenta múltiplas combinações de correspondência antes de falhar ou suceder, podendo travar a aplicação ou deixá-la lenta demais para responder.

Exemplo

Um validador de email com regex como `(a+)+b` recebe a string `aaaaaaaaaaaaaaaaaaaaX` (sem o caractere final esperado). O motor testa todas as combinações de agrupamento do `a` repetido, levando tempo exponencial em relação ao tamanho da entrada.

Como mitigar

Use bibliotecas de parsing ou validação especializadas em vez de regex complexas (ex: bibliotecas de email ou URL). Se regex for necessária, teste com inputs longos malformados, limpe a entrada antes, ou use engines regex com proteção contra backtracking (como a do Rust).

CVE-2026-49851HIGHMistune: Potential DoS via quadratic-time parsing in parse_link_textEPSS 0.5%CVE-2020-26308HIGHGHSL-2020-302: Regular Expression Denial of Service (ReDoS) in validate.jsEPSS 0.5%CVE-2020-26311HIGHGHSL-2020-312: Regular Expression Denial of Service (ReDoS) in useragentEPSS 0.5%CVE-2026-35458HIGHGotenberg has a ReDoS via extraHttpHeaders scope featureEPSS 0.5%CVE-2026-4867HIGHpath-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parametersEPSS 0.5%CVE-2026-73556MEDIUMvLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574EPSS 0.5%CVE-2026-107290MEDIUMPydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`EPSS 0.5%CVE-2026-55520HIGHProtego: Exponential backtracking ReDoS in robots.txt URL wildcard matchingEPSS 0.5%CVE-2026-66766HIGHDenial of Service (DoS) in SAP S/4HANA (Manage Supply Protection)EPSS 0.5%CVE-2026-67991HIGHcrmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition EPSS 0.5%CVE-2026-66062MEDIUMSvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept headerEPSS 0.5%CVE-2026-85062MEDIUMColord: Slow rejection of oversized malformed color stringsEPSS 0.5%CVE-2024-21539HIGHVersions of the package @eslint/plugin-kit before 0.2.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper inputEPSS 0.5%CVE-2026-115822HIGHStarman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodiesEPSS 0.5%CVE-2023-6502MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.5%CVE-2026-123792HIGHSymfony: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a ProcessEPSS 0.5%CVE-2025-9670MEDIUMmixmark-io turndown commonmark-rules.js redosEPSS 0.5%CVE-2024-41766HIGHIBM Engineering Lifecycle Optimization - Publishing denial of serviceEPSS 0.5%CVE-2026-30925HIGHParse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQueryEPSS 0.5%CVE-2025-3933MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.5%