Falhas do tipo CWE-1333

411 resultados

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex que, em certos padrões de entrada, causa backtracking excessivo e consome CPU de forma exponencial. O motor regex tenta múltiplas combinações de correspondência antes de falhar ou suceder, podendo travar a aplicação ou deixá-la lenta demais para responder.

Exemplo

Um validador de email com regex como `(a+)+b` recebe a string `aaaaaaaaaaaaaaaaaaaaX` (sem o caractere final esperado). O motor testa todas as combinações de agrupamento do `a` repetido, levando tempo exponencial em relação ao tamanho da entrada.

Como mitigar

Use bibliotecas de parsing ou validação especializadas em vez de regex complexas (ex: bibliotecas de email ou URL). Se regex for necessária, teste com inputs longos malformados, limpe a entrada antes, ou use engines regex com proteção contra backtracking (como a do Rust).

CVE-2026-23985MEDIUMApache Superset: Regular Expression Denial of Service (ReDoS) in SQL ParserEPSS 0.4%CVE-2025-5890MEDIUMactions toolkit glob internal-pattern.ts globEscape redosEPSS 0.4%CVE-2026-63460HIGHVendure: Unauthenticated ReDoS via `regex` filter on SQLite backendsEPSS 0.4%CVE-2026-45409MEDIUMInternationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fixEPSS 0.4%CVE-2020-26310HIGHGHSL-2020-305: Regular Expression Denial of Service (ReDoS) in Pure JavaScript HTML5 ParserEPSS 0.4%CVE-2020-26307HIGHGHSL-2020-301: Regular Expression Denial of Service (ReDoS) in HTML2MarkdownEPSS 0.4%CVE-2026-33671HIGHPicomatch has a ReDoS vulnerability via extglob quantifiersEPSS 0.4%CVE-2026-34939MEDIUMPraisonAI: ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()EPSS 0.4%CVE-2025-33090HIGHIBM Concert Software denial of serviceEPSS 0.4%CVE-2025-54363MEDIUMMicrosoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module. extract_full_summary_from_signEPSS 0.4%CVE-2025-45143HIGHstring-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input.EPSS 0.4%CVE-2025-5197MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.4%CVE-2025-26042MEDIUMUptime Kuma >== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. If a stEPSS 0.4%CVE-2025-55152MEDIUMoak: ReDoS in x-forwarded-proto and x-forwarded-for headersEPSS 0.4%CVE-2026-62672MEDIUMGrav: Authenticated ReDoS via regex_replace in Twig SandboxEPSS 0.4%CVE-2025-2937MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.4%CVE-2026-45617HIGHLiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter RegexEPSS 0.4%CVE-2025-6051MEDIUMRegular Expression Denial of Service (ReDoS) in huggingface/transformersEPSS 0.4%CVE-2026-67991HIGHcrmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition EPSS 0.4%CVE-2026-60075HIGHDate::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_timeEPSS 0.4%