Weakness (CWE)
CWE-1333: Inefficient Regular Expression Complexity
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
How to prevent it (4 mitigations)
-
Architecture and Design
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
-
System Configuration
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
-
Implementation
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
-
Implementation
Limit the length of the input that the regular expression will process.
Source: MITRE CWE-1333
275 results · Clear filters · Feed
-
High 7.5
Regular expression denial of service in Rust's regex crate
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations…
-
High 7.5
Exponential catastrophic backtracking (ReDoS) in marked
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulne…
-
High 7.5
Cubic catastrophic backtracking (ReDoS) in marked
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown throu…
-
High 7.5
Inefficient Regular Expression Complexity in nltk/nltk
nltk is vulnerable to Inefficient Regular Expression Complexity
-
High 7.5
Regular expression denial of service vulnerability (ReDoS) in date
Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.
-
High 7.5
ReDos vulnerability on guest checkout email validation
Solidus is a free, open-source ecommerce platform built on Rails. Versions of Solidus prior to 3.1.4, 3.0.4, and 2.11.13 have a denial of service vulnerability that could be exploited during a guest checkout. The regular expression used to validate a guest or…
-
High 7.5
Regular Expression Denial of Service (ReDoS)
The package handsontable before 10.0.0; the package handsontable from 0 and before 10.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) in Handsontable.helper.isNumeric function.
-
High 7.5
Inefficient Regular Expression Complexity in nltk/nltk
nltk is vulnerable to Inefficient Regular Expression Complexity
-
High 7.5
Regular Expression Denial of Service in Leo Editor
Leo Editor v6.2.1 was discovered to contain a regular expression denial of service (ReDoS) vulnerability in the component plugins/importers/dart.py.
-
High 7.5
Regular Expression Denial of Service in flask-restx
Flask-RESTX (pypi package flask-restx) is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS (Regular Expression Denial of Service) in email_regex. This is fixed in version 0.5.1.
-
High 7.5
Inefficient Regular Expression Complexity in cdr/code-server
code-server is vulnerable to Inefficient Regular Expression Complexity
-
High 7.5
Inefficient Regular Expression Complexity in nervjs/taro
taro is vulnerable to Inefficient Regular Expression Complexity
-
High 7.5
Inefficient Regular Expression Complexity in chalk/ansi-regex
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
-
High 7.5
Inefficient Regular Expression Complexity in fb55/nth-check
nth-check is vulnerable to Inefficient Regular Expression Complexity
-
High 7.5
Inefficient Regular Expression Complexity in sindresorhus/semver-regex
semver-regex is vulnerable to Inefficient Regular Expression Complexity
-
High 7.5
Inefficient Regular Expression Complexity in prismjs/prism
prism is vulnerable to Inefficient Regular Expression Complexity
-
High 7.5
Inefficient Regular Expression Complexity in vuelidate/vuelidate
vuelidate is vulnerable to Inefficient Regular Expression Complexity
-
High 7.5
Inefficient Regular Expression Complexity in daaku/nodejs-tmpl
nodejs-tmpl is vulnerable to Inefficient Regular Expression Complexity
-
High 7.5CVE-2021-3749 Public exploit
Inefficient Regular Expression Complexity in axios/axios
axios is vulnerable to Inefficient Regular Expression Complexity
-
High 7.5
Inefficient Regular Expression Complexity in chatwoot/chatwoot
chatwoot is vulnerable to Inefficient Regular Expression Complexity
-
High 7.5
Regular Expression Denial of Service in Addressable templates
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addr…
-
High 7.5
Regular expression denial of service in react-native
A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1.
-
High 7.5
markdown2 Regular Expression Denial of Service
markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an extended period of time.
-
High 7.5
Regular Expression Denial of Service in System.Text.RegularExpressions
A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.
-
High 7.5
Regular Expression Denial of Service in remarkable
lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section.
-
High 7.5
Regular Expression Denial of Service in highcharts
In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS.
-
High 7.5
ReDoS in brace-expansion
index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as demonstrated by an expand argument containing many comma characters.
-
High 7.5
Regular Expression Denial of Service in marked
The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular expression denial of service (ReDoS)."
-
High 7.5
Regular Expression Denial of Service in semver
The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."
-
High 7.5
Regular Expression Denial of Service in uglify-js
The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a "regular expression denial of service (ReDoS)."
-
High 7.5
Regular Expression Denial of Service in ms
The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."
-
High 7.5
Regular Expression Denial of Service in hawk
Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long (1) header or (2) URI that is matched against an improper regular expression.
-
High 7.5
Regular Expression Denial of Service in is-my-json-valid
The is-my-json-valid package before 2.12.4 for Node.js has an incorrect exports['utc-millisec'] regular expression, which allows remote attackers to cause a denial of service (blocked event loop) via a crafted string.
-
High 7.5
Django ReDoS in validators.URLValidator
validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
-
High 7.5
Django Regex Algorithmic Complexity Causes Denial of Service
Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a…