Falhas do tipo CWE-1333

405 resultados

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex que, em certos padrões de entrada, causa backtracking excessivo e consome CPU de forma exponencial. O motor regex tenta múltiplas combinações de correspondência antes de falhar ou suceder, podendo travar a aplicação ou deixá-la lenta demais para responder.

Exemplo

Um validador de email com regex como `(a+)+b` recebe a string `aaaaaaaaaaaaaaaaaaaaX` (sem o caractere final esperado). O motor testa todas as combinações de agrupamento do `a` repetido, levando tempo exponencial em relação ao tamanho da entrada.

Como mitigar

Use bibliotecas de parsing ou validação especializadas em vez de regex complexas (ex: bibliotecas de email ou URL). Se regex for necessária, teste com inputs longos malformados, limpe a entrada antes, ou use engines regex com proteção contra backtracking (como a do Rust).

CVE-2024-28716HIGHAn issue in OpenStack Storlets yoga-eom allows a remote attacker to execute arbitrary code via the gateway.py component.EPSS 1.4%CVE-2020-1920—A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resoEPSS 1.4%CVE-2022-4891LOWSisimai string.rb to_plain redosEPSS 1.3%CVE-2022-24373MEDIUMRegular Expression Denial of Service (ReDoS)EPSS 1.3%CVE-2022-25918MEDIUMRegular Expression Denial of Service (ReDoS)EPSS 1.3%CVE-2023-2198HIGHAn issue has been discovered in GitLab CE/EE affecting all versions starting from 8.7 before 15.10.8, all versions starting from 15.11 beforEPSS 1.3%CVE-2024-22640HIGHTCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.EPSS 1.3%CVE-2023-2199HIGHAn issue has been discovered in GitLab CE/EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 befoEPSS 1.3%CVE-2023-2132HIGHAn issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 befoEPSS 1.3%CVE-2022-42124HIGHReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through EPSS 1.3%CVE-2022-37259HIGHA Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the string variable in babel.js.EPSS 1.3%CVE-2021-3777HIGHInefficient Regular Expression Complexity in daaku/nodejs-tmplEPSS 1.3%CVE-2022-2596MEDIUMInefficient Regular Expression Complexity in node-fetch/node-fetchEPSS 1.3%CVE-2023-26112LOWAll versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\EPSS 1.3%CVE-2021-3804HIGHInefficient Regular Expression Complexity in nervjs/taroEPSS 1.3%CVE-2021-3810HIGHInefficient Regular Expression Complexity in cdr/code-serverEPSS 1.3%CVE-2024-10270MEDIUMOrg.keycloak:keycloak-services: keycloak denial of serviceEPSS 1.3%CVE-2023-26103MEDIUMVersions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket functiEPSS 1.2%CVE-2021-3649HIGHInefficient Regular Expression Complexity in chatwoot/chatwootEPSS 1.2%CVE-2021-3820MEDIUMInefficient Regular Expression Complexity in pksunkara/inflectEPSS 1.2%