Falhas do tipo CWE-1333

407 resultados

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex que, em certos padrões de entrada, causa backtracking excessivo e consome CPU de forma exponencial. O motor regex tenta múltiplas combinações de correspondência antes de falhar ou suceder, podendo travar a aplicação ou deixá-la lenta demais para responder.

Exemplo

Um validador de email com regex como `(a+)+b` recebe a string `aaaaaaaaaaaaaaaaaaaaX` (sem o caractere final esperado). O motor testa todas as combinações de agrupamento do `a` repetido, levando tempo exponencial em relação ao tamanho da entrada.

Como mitigar

Use bibliotecas de parsing ou validação especializadas em vez de regex complexas (ex: bibliotecas de email ou URL). Se regex for necessária, teste com inputs longos malformados, limpe a entrada antes, ou use engines regex com proteção contra backtracking (como a do Rust).

CVE-2018-25074LOWPrestaul skeemas base.js redosEPSS 0.9%CVE-2023-3424HIGHInefficient Regular Expression Complexity in GitLabEPSS 0.9%CVE-2024-45801HIGHTampering by prototype polution in DOMPurifyEPSS 0.9%CVE-2022-1930MEDIUMReDoS in eth-account encode_structured_data functionEPSS 0.9%CVE-2018-25077LOWmelnaron mel-spintax spintax.js redosEPSS 0.9%CVE-2024-45338MEDIUMNon-linear parsing of case-insensitive content in golang.org/x/net/htmlEPSS 0.9%CVE-2025-4727MEDIUMMeteor livedata_server.js Object.assign redosEPSS 0.9%CVE-2024-21538HIGHVersions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS)EPSS 0.9%CVE-2023-23621HIGHDiscourse vulnerable to ReDoS in user agent parsingEPSS 0.9%CVE-2022-42964MEDIUMExponential ReDoS in pymatgen leads to denial of serviceEPSS 0.9%CVE-2022-42965LOWExponential ReDoS in snowflake-connector-python leads to denial of serviceEPSS 0.9%CVE-2024-39316MEDIUMRack ReDoS Vulnerability in HTTP Accept Headers ParsingEPSS 0.9%CVE-2023-3205MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 0.8%CVE-2022-3514MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before EPSS 0.8%CVE-2024-22363HIGHSheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS).EPSS 0.8%CVE-2022-4131MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 15.5.7, all versions starting from 15.6 beforeEPSS 0.8%CVE-2025-25200CRITICALKoa has Inefficient Regular Expression ComplexityEPSS 0.8%CVE-2025-6998HIGHCalibre Web 0.6.24 & Autocaliweb 0.7.0 - ReDoSEPSS 0.8%CVE-2024-39249HIGHAsync <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function. NOEPSS 0.8%CVE-2024-52524MEDIUMReDoS in Giskard Scan text perturbationEPSS 0.8%