CWE-1333: ReDoS
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Also known as Inefficient Regular Expression Complexity, Regular Expression Denial of Service, Catastrophic backtracking.
A kind of CWE-407 Inefficient Algorithmic Complexity.
From the CWE List. © The MITRE Corporation.
Newest
- spring framework, vmware spring framework +1 moreSpring Framework Denial of Service via AntPathMatcher3.7 Low
- yeswikiYesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)9.8 Critical
- kokke tiny-regex-ckokke tiny-regex-c Pattern re.c matchstar redos4.8 Medium
- axios, red hat cryostat 4, gatekeeper 3 +62 more +64 moreAxios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection7.5 High
- securly, securly chrome extension +1 moreCVE-2026-88887.5 High
- johnhuang316 code-index-mcpjohnhuang316 code-index-mcp search_code_advanced is_safe_regex_pattern redos5.3 Medium
- wonderwhy-er desktopcommandermcpwonderwhy-er DesktopCommanderMCP start_search search-manager.ts redos5.3 Medium
- enderfga claw-orchestratorEnderfga claw-orchestrator Session Grep Endpoint embedded-server.ts validateRegex redos5.3 Medium
- sensiolabs symfony, symfony json-path +1 moreSymfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS8.2 High
- eemeli yaml, sensiolabs symfony +1 moreSymfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex8.7 High
- sensiolabs symfonySymfony: [Yaml] Harden the parser when handling untrusted input8.2 High
- harttle liquidjsLiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter Regex7.5 High
pacotenpm,grafana12.4Red Hat,nodejsAlmaLinux +20 more +22 morepacote is vulnerable to Denial of Service (DoS) via the addGitSha function8.7 High- parse-community parse-serverParse Server: Pre-authentication denial of service via client version header regex backtracking8.7 High
- kjd idna, internationalized domain names in applications +1 moreInternationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix6.9 Medium
- hapifhir org.hl7.fhir.coreHAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint7.5 High
- svelteSvelte: ReDoS in `<svelte:element>` Tag Validation5.9 Medium
- nautobotNautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)6.5 Medium
- multipartymultiparty vulnerable to ReDoS via filename parsing7.5 High
- shellhubShellHub: Crash-DoS via field injection in filter and sort-by parameters5.4 Medium
- nokogiriNokogiri before 1.19.3 ReDoS via CSS selector tokenizer8.7 High
- lepture mistune, red hat migration toolkit for applications 8.2, openshift ai (rhoai) +2 more +4 moreMistune ReDoS in LINK_TITLE_RE allows denial of service with crafted Markdown titles8.7 High
- growi, inc. growiGROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via...8.7 High
- signalk signal k server, signalk-server +1 moreSignal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths7.5 High
- giskard, giskard-ai giskard-oss +1 moreGiskard has a Regular Expression Denial of Service (ReDoS) in RegexMatching Check1.0 Low
- zod jsvideourlparserZod jsVideoUrlParser util.js getTime redos6.9 Medium
- nearform fast-jwtReDoS in fast-jwt when using RegExp in allowed* leading to CPU exhaustion during token verification4.2 Medium
skilletonnpmskilleton has improper input handling in repository/path processing6.9 Medium- addressable project addressableAddressable has a Regular Expression Denial of Service in Addressable templates7.5 High
- gotenbergGotenberg has a ReDoS via extraHttpHeaders scope feature8.7 High
- content project contentRegular Expression Denial of Service (ReDoS) in @hapi/content HTTP header parsing8.7 High
- hapijs @hapi/content@hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing8.7 High
- mervinpraison praisonaiPraisonAI: ReDoS via Unvalidated User-Controlled Regex in MCPToolIndex.search_tools()6.5 Medium
- path-to-regexppath-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards5.9 Medium
- path-to-regexp, red hat cryostat 4, cryostat 4 on rhel 9 +49 more +51 morepath-to-regexp vulnerable to Denial of Service via sequential optional groups7.5 High
- jonschlinkert picomatchPicomatch has a ReDoS vulnerability via extglob quantifiers7.5 High
- rubyonrails rails, rails activesupport +1 moreRails Active Support has a possible ReDoS vulnerability in number_to_delimited6.9 Medium
pygmentsDebian,python-pygmentsMageia +1 morepygments archetype.py AdlLexer redos4.8 Medium- defnull multipart, red hat lightspeed core, openshift lightspeed +8 more +10 moreReDoS in multipart 1.3.0 - `parse_options_header()`7.5 High
- elysiajs elysiaElysia has a string URL format redos7.5 High
- parse-community parse-serverParse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery8.2 High
- mscdex ssh2An issue pertaining to CWE-1333: Inefficient Regular Expression Complexity (4.19) was discovered...7.5 High
- sunbird sunbirded-portalAn issue pertaining to CWE-1333: Inefficient Regular Expression Complexity (4.19) was discovered...7.5 High
- yhirose cpp-httplibcpp-httplib: Stack Overflow Denial of Service (DoS) via std::regex in multipart filename parsing5.9 Medium
- openclawOpenClaw < 2026.2.19 - ReDoS and Regex Injection via Unescaped Feishu Mention Metadata6.9 Medium
- snowflake jdbc, snowflakedb snowflake-jdbc +1 moresnowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redos4.8 Medium
- elastic kibanaInefficient Regular Expression Complexity in Kibana Leading to Denial of Service4.9 Medium
- isaacs minimatchminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions7.5 High
- gitlabInefficient Regular Expression Complexity in GitLab7.5 High
- isaacs minimatchminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern8.7 High
- Show moreLoading…