CWE-1333: ReDoS
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Also known as Inefficient Regular Expression Complexity, Regular Expression Denial of Service, Catastrophic backtracking.
A kind of CWE-407 Inefficient Algorithmic Complexity.
From the CWE List. © The MITRE Corporation.
Newest
- ibm api connect IBM API Connect Denial of Service 9.6 Critical
- sensiolabs symfony Symfony: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process 8.7 High
- parse-community parse-server Parse Server 9.0.0 before 9.10.7-alpha.1 ReDoS via Email Validation Regex 8.7 High
-
libcgi-pm-perlDebian,perl-CGIAzure Linux +1 more CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list No score -
libcgi-pm-perlDebian,perl-CGIAzure Linux +1 more CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type No score -
libcgi-pm-perlDebian,perl-CGIopenSUSE +1 more CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse No score - lucasrodes whatstk Unescaped header separators in whatstk build a regular expression that backtracks exponentially 6.7 Medium
- delgan loguru Delgan loguru ANSI Color-Markup _colorizer.py AnsiParser.feed redos 5.3 Medium
- ring-clojure ring Ring's nested-params middleware has inefficient regular expression complexity 7.5 High
- wekan Wekan: ReDoS via Unescaped User Input in RegExp 6.5 Medium
- No product listed CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI 7.5 High
-
starletDebian Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies 7.5 High - hapijs content @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service 7.5 High
- @hapi joi joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service 7.5 High
- espocrm EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex 8.7 High
- n8n-io n8n n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node 7.1 High
- open-telemetry opentelemetry-java opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing 5.3 Medium
-
libmime-tools-perlDebian,perl-MIME-toolsopenSUSE +1 more MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters 7.5 High -
libhttp-body-perlDebian,perl-HTTP-BodyopenSUSE +1 more HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload 7.5 High -
libhttp-body-perlDebian,perl-HTTP-BodyopenSUSE +1 more HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies 7.5 High - le0pard re2js RE2JS: Quadratic-time denial of service in re2js lookbehind matching 7.5 High
- progress software telerik document processing libraries Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessing 7.5 High
- datadog dd-trace-js dd-trace: ReDOS in URL query string obfuscation 8.7 High
- datadog dd-trace-py Datadog dd-trace-py: ReDOS in URL query string obfuscation 8.7 High
-
starmanDebian,perl-StarmanopenSUSE +1 more Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies 7.5 High - graphql-hive graphql-scalars graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service 7.5 High
- unclecode crawl4ai Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fields 7.1 High
- lepture mistune Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing 8.7 High
- open-telemetry opentelemetry-python OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api 5.3 Medium
- python pillow Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes 6.9 Medium
- diffsk configobj DiffSK configobj __init__.py _sectionmarker redos 6.9 Medium
- micromatch picomatch Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns 8.7 High
- beaugunderson ip-address Duplicate Advisory: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process 6.3 Medium
- tandoorrecipes recipes Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns 5.7 Medium
- amauric tarteaucitron.js tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge 2.3 Low
- adonisjs http-server AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity 8.7 High
- sensiolabs symfony Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header 8.7 High
- nodemailer Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes 8.7 High
- gitpython-developers gitpython GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date 8.7 High
- micropyramid bottlecrm BottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex 6.9 Medium
- rdfjs n3.js N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex 8.7 High
- open-webui Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop 5.3 Medium
- satel netco design Satel Netco Design Inefficient Regular Expression Complexity 7.1 High
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 more Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch` 6.5 Medium
- progressive robot ltd hmailserver Inefficient Regular Expression Complexity in hMailServer 6.5 Medium
- twisted Twisted: IMAP wildcardToRegexp() ReDoS 4.3 Medium
- elastic elasticsearch Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service 4.3 Medium
- quasarframework quasar Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server 8.7 High
- payloadcms payload Payload: ReDoS in Multipart Content-Type Validation 8.7 High
- tryghost ghost Ghost: Regular Expression Denial of Service in Content Import 4.9 Medium
- Show olderLoading…