Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1333: Inefficient Regular Expression Complexity

Base Draft

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

How to prevent it (4 mitigations)

  1. Architecture and Design

    Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.

  2. System Configuration

    Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.

  3. Implementation

    Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.

  4. Implementation

    Limit the length of the input that the regular expression will process.

Source: MITRE CWE-1333

All Critical High Medium Low Exploited only Public exploit

47 results · Clear filters · Feed

  • Low 3.5
    CVE-2021-4306

    cronvel terminal-kit redos

    A vulnerability classified as problematic has been found in cronvel terminal-kit up to 2.1.7. Affected is an unknown function. The manipulation leads to inefficient regular expression complexity. Upgrading to version 2.1.8 is able to address this issue. The n…

    cronvel terminal-kit terminal-kit npm
  • Low 3.5
    CVE-2021-4305

    Woorank robots-txt-guard patterns.js makePathPattern redos

    A vulnerability was found in Woorank robots-txt-guard. It has been rated as problematic. Affected by this issue is the function makePathPattern of the file lib/patterns.js. The manipulation of the argument pattern leads to inefficient regular expression compl…

    Woorank robots-txt-guard robots-txt-guard npm
  • Low 3.0
    CVE-2018-25049

    email-existence index.js redos

    A vulnerability was found in email-existence. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The name of the patch is 0029ba71b6…

    email-existence npm
  • Low 3.5
    CVE-2015-10005

    markdown-it html_re.js redos

    A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/html_re.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3.0.0 is ab…

    node-markdown-it markdown-it Ubuntu npm
  • Low 3.7
    CVE-2022-42965

    Exponential ReDoS in snowflake-connector-python leads to denial of service

    An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the undocumented get_file_transfer_type method

    snowflake-connector-python snowflake-connector-python snowflake-connector-python PyPI
  • Low —
    GHSA-ch52-vgq2-943f

    Regular Expression Denial of Service in marked

    Affected versions of `marked` are vulnerable to Regular Expression Denial of Service (ReDoS). The `_label` subrule may significantly degrade parsing performance of malformed input. ## Recommendation Upgrade to version 0.7.0 or later.

    marked npm
  • Low —
    GHSA-wxhq-pm8v-cw75

    Regular Expression Denial of Service in clean-css

    Version of `clean-css` prior to 4.1.11 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial …

    clean-css npm