Weakness (CWE)
CWE-1333: Inefficient Regular Expression Complexity
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
How to prevent it (4 mitigations)
-
Architecture and Design
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
-
System Configuration
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
-
Implementation
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
-
Implementation
Limit the length of the input that the regular expression will process.
Source: MITRE CWE-1333
259 results · Clear filters · Feed
-
Medium 5.5
Regular Expression Denial of Service (ReDoS) Vulnerability
formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this …
-
Medium 4.3
Segmentio is-url index.js redos
A vulnerability was found in Segmentio is-url up to 1.2.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be laun…
-
Medium 5.3
http-cache-semantics vulnerable to Regular Expression Denial of Service
This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
-
Medium 5.3CVE-2022-25927 Public exploit
ReDoS Vulnerability in ua-parser-js version
Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.
-
Medium 5.3
cookiejar Regular Expression Denial of Service via Cookie.parse function
Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an insecure regular expression.
-
Medium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 15.5.7, all versions star…
-
Medium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions start…
-
Medium 4.3
vercel ms index.js parse redos
A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be…
-
Medium 6.5
Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.bet…
-
Medium 6.2
Regular expression Denial of Service in MooTools
MooTools is a collection of JavaScript utilities for JavaScript developers. All known versions include a CSS selector parser that is vulnerable to Regular Expression Denial of Service (ReDoS). An attack requires that an attacker can inject a string into a CSS…
-
Medium 4.3
cronvel string-kit naturalSort.js naturalSort redos
A vulnerability classified as problematic was found in cronvel string-kit up to 0.12.7. This vulnerability affects the function naturalSort of the file lib/naturalSort.js. The manipulation leads to inefficient regular expression complexity. The attack can be …
-
Medium 4.3
rgb2hex redos
A vulnerability was found in rgb2hex up to 0.1.5. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to inefficient regular expression complexity. The attack may be initiated remotely. Upgrading to version 0.1…
-
Medium 5.9
pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS)
Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
-
Medium 5.9
Exponential ReDoS in pymatgen leads to denial of service
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the GaussianInput.from_string method
-
Medium 5.9
Exponential ReDoS in cleo leads to denial of service
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to the Table.set_rows method
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function.
-
Medium 4.3
A potential DoS vulnerability was discovered in Gitlab CE/EE versions starting from 10.7 before 15.1.5, all versions st…
-
Medium 5.3
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Servi…
-
Medium 6.8
Dell Wyse ThinOS 2205 contains a Regular Expression Denial of Service Vulnerability in UI. An admin privilege attacker …
-
Medium 5.9
Regular expression denial of service in dparse
dparse is a parser for Python dependency files. dparse in versions before 0.5.2 contain a regular expression that is vulnerable to a Regular Expression Denial of Service. All the users parsing index server URLs with dparse are impacted by this vulnerability. …
-
Medium 5.0
Dell Hybrid Client prior to version 1.8 contains a Regular Expression Denial of Service Vulnerability in the UI. An adv…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse funct…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
The package react-native-reanimated before 3.0.0-rc.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper usage of regular expression in the parser of Colors.js.
-
Medium 5.9
Shescape Inefficient Regular Expression Complexity vulnerability
Shescape is a shell escape package for JavaScript. An Inefficient Regular Expression Complexity vulnerability impacts users that use Shescape to escape arguments for the Unix shells `Bash` and `Dash`, or any not-officially-supported Unix shell; and/or using t…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.
-
Medium 5.9
ReDoS in uri-template-lite URI.expand function
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the "URI.expand" method
-
Medium 5.9
ReDoS in eth-account encode_structured_data function
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the eth-account PyPI package, when an attacker is able to supply arbitrary input to the encode_structured_data method
-
Medium 5.9
Inefficient Regular Expression Complexity in node-fetch/node-fetch
Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10.
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of insecure regex.
-
Medium 5.3
Denial of Service (DoS) vulnerability in RSSHub
RSSHub is an open source, extensible RSS feed generator. In commits prior to 5c4177441417 passing some special values to the `filter` and `filterout` parameters can cause an abnormally high CPU. This results in an impact on the performance of the servers and …
-
Medium 6.5
Denial of Service in python-ldap
python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. By sending crafted regex input, a remote authent…
-
Medium 5.9
Exponential ReDoS in devcert
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to the certificateFor method
-
Medium 5.9
Exponential ReDoS in markdown-link-extractor
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function
-
Medium 5.9
Exponential ReDoS in semver-regex
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method
-
Medium 5.9
Exponential ReDoS in jquery-validation
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method
-
Medium 5.5
Missing fix for CVE-2022-30126 in 1.28.2
We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
All versions of package url-regex are vulnerable to Regular Expression Denial of Service (ReDoS) which can cause the CPU usage to crash.
-
Medium 5.5
Apache Tika Regular Expression Denial of Service in Standards Extractor
In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractin…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value…