{"id":"CVE-2026-57577","aliases":["EUVD-2026-77699","GHSA-c2g3-c4gc-w5wg"],"status":"published","title":"DotVVM: ReDOS in routing","description":"DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00577,"percentile":0.47987,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333"],"published":"2026-06-19T15:08:10Z","modified":"2026-10-28T02:30:43Z","fixes":[{"ecosystem":"NuGet","package":"DotVVM","fixed_in":["4.2.11","4.3.15","5.0.0-preview09-final"],"sources":["ghsa"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"DotVVM","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"DotVVM","ranges":[{"type":"UNPARSED","raw":"\u003e 4.3.0-preview01-final, \u003c 4.3.15","events":[{"fixed":"4.3.15"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"DotVVM","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0-preview01-final"},{"fixed":"5.0.0-preview09-final"}]}]}],"products":[{"vendor":"riganti","product":"dotvvm"}],"references":[{"url":"https://github.com/riganti/dotvvm/security/advisories/GHSA-c2g3-c4gc-w5wg","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/riganti/dotvvm/commit/1635245b5eaf9ccf8e3536b9d8b1941819526585","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/riganti/dotvvm/commit/4fc26a8591c76fb92ed701352c2a84120cf926c5","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/riganti/dotvvm/commit/5728ab80fff9af883b44d11c118d2e8a8991dcd4","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/riganti/dotvvm/releases/tag/v4.3.15","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/riganti/dotvvm/releases/tag/v5.0.0-preview09","tags":["x_refsource_MISC","web"]},{"url":"https://www.dotvvm.com/docs/4.0/pages/concepts/routing/parameters#route-constraints"},{"url":"https://github.com/advisories/GHSA-c2g3-c4gc-w5wg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57577.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57577","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-57577","title":"DotVVM: ReDOS in routing","description":"DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.","status":"published","published":"2026-09-14T17:37:54.739Z","modified":"2026-09-14T17:54:30.539Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T13:43:44.898272Z"}],"euvd":[{"id":"EUVD-2026-77699","description":"DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.","status":"published","published":"2026-09-14T17:37:54Z","modified":"2026-09-14T17:54:30Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:20.0825Z"}],"ghsa":[{"id":"GHSA-c2g3-c4gc-w5wg","title":"ReDoS in DotVVM routing","description":"### Impact\n\nThis impacts users which use multiple unconstrained route parameters not separated by a `/`. For instance, the following code is vulnerable:\n```\nvar route = new DotvvmRoute(\"edit/{a}-{b}-{c}/done\", null, \"testpage\", null, null, configuration);\n\nvar adversarialInput = \"edit/\" + new string('-', 32000);\nroute.IsMatch(adversarialInput, out _);\n```\n\n### Patches\n\nDotVVM versions 4.3.15, 4.2.11 and 5.0.0-preview09 apply a 1 second timeout to route regex operations. When it is triggered, DotVVM permanently switches to using the .NET non-backtracking regex engine for this route.\nIf non-backtracking is not supported by target runtime (\u003c .NET 8.0), DotVVM returns HTTP 503 when the 1 second timeout is reached.\n\n### Workarounds\n\nAvoid multiple unconstrained route parameters in one section not separated by a `/`.\nSee  for documentation of route parameter constraints.\nEven with the patched version we recommend doing this both as security hardening and to avoid ambiguity.\n\nFor instance, when we change the route URL to `\"edit/{a:alpha}-{b:alpha}-{c}/done\"`, the problem disappears.\nIf all available constraints are too restrictive, we can still use `{a:regex([^-]*)}` to forbid the `-`, which is enough to remove the mabiguity","status":"published","published":"2026-06-19T15:08:10Z","modified":"2026-06-19T15:08:11Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:40:30.53004Z"}],"nvd":[{"id":"CVE-2026-57577","description":"DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.","status":"published","published":"2026-09-14T18:17:57.353Z","modified":"2026-09-30T19:57:08.043Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:12:46.980627Z"}],"osv":[{"id":"CVE-2026-57577","title":"DotVVM: ReDOS in routing","description":"DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.","status":"published","published":"2026-09-14T17:37:54.739Z","modified":"2026-10-28T02:30:43.762820518Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:45:12.016252Z"}]}}