Falhas do tipo CWE-1333

484 resultados

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex que, em certos padrões de entrada, causa backtracking excessivo e consome CPU de forma exponencial. O motor regex tenta múltiplas combinações de correspondência antes de falhar ou suceder, podendo travar a aplicação ou deixá-la lenta demais para responder.

Exemplo

Um validador de email com regex como `(a+)+b` recebe a string `aaaaaaaaaaaaaaaaaaaaX` (sem o caractere final esperado). O motor testa todas as combinações de agrupamento do `a` repetido, levando tempo exponencial em relação ao tamanho da entrada.

Como mitigar

Use bibliotecas de parsing ou validação especializadas em vez de regex complexas (ex: bibliotecas de email ou URL). Se regex for necessária, teste com inputs longos malformados, limpe a entrada antes, ou use engines regex com proteção contra backtracking (como a do Rust).

CVE-2025-3933MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.5%CVE-2025-3263MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.5%CVE-2025-61921LOWSinatra has ReDoS vulnerability in ETag header value generationEPSS 0.5%CVE-2025-54796HIGHCopyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" pageEPSS 0.5%CVE-2025-3262MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.5%CVE-2026-79770HIGHNokogiri before 1.19.3 ReDoS via CSS selector tokenizerEPSS 0.5%CVE-2025-1194MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.5%CVE-2026-67413MEDIUMRabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an Unbounded LIKE Regular ExpressionEPSS 0.5%CVE-2026-118259MEDIUMopentelemetry-java: Quadratic CPU consumption in W3C tracestate parsingEPSS 0.5%CVE-2024-1493MEDIUMUncontrolled Resource Consumption in GitLabEPSS 0.5%CVE-2026-115887HIGHgraphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of serviceEPSS 0.5%CVE-2026-114603MEDIUMOpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-apiEPSS 0.5%CVE-2025-68142LOWPyMdown Extensions has ReDOS bug in Figure Capture extensionEPSS 0.5%CVE-2026-16270MEDIUMReDoS in Open MercatoEPSS 0.5%CVE-2025-71379MEDIUMvllm - Regular Expression Denial of Service in Multiple ComponentsEPSS 0.5%CVE-2024-58340HIGHLangChain <= 0.3.1 MRKLOutputParser ReDoSEPSS 0.5%CVE-2025-53539MEDIUMReDoS in fastapi-guard's penetration attempts detectorEPSS 0.5%CVE-2026-108082HIGHSymfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request HeaderEPSS 0.5%CVE-2020-26305HIGHGHSL-2020-291: Regular Expression Denial of Service (ReDoS) in CommonRegexJSEPSS 0.5%CVE-2026-0668MEDIUMVisualData extension: Regular Expression Denial of Service (ReDoS) via crafted user inputEPSS 0.5%