Weakness (CWE)
CWE-1333: Inefficient Regular Expression Complexity
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
How to prevent it (4 mitigations)
-
Architecture and Design
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
-
System Configuration
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
-
Implementation
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
-
Implementation
Limit the length of the input that the regular expression will process.
Source: MITRE CWE-1333
2 results · Clear filters · Feed
-
Low 3.7CVE-2024-9506 Public exploit
Regular Expression Denial of Service (ReDoS)
Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability.
-
Low 3.5CVE-2017-20165 Public exploit
debug-js debug node.js useColors redos
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version …