CWE-1333: ReDoS
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Also known as Inefficient Regular Expression Complexity, Regular Expression Denial of Service, Catastrophic backtracking.
A kind of CWE-407 Inefficient Algorithmic Complexity.
From the CWE List. © The MITRE Corporation.
Newest
- tryghost ghostGhost: Regular Expression Denial of Service in External Media Inliner4.9 Medium
- mwilliamson mammoth.jsMammoth.js 1.3.0 before 1.12.3 ReDoS via Style Map Tokeniser8.7 High
- nodeca probe-image-sizeprobe-image-size: Quadratic-time Denial of Service in the SVG Parser7.5 High
- yeswikiYesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint6.9 Medium
- apache software foundation thriftApache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic)8.2 High
- No product listedcrmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time...7.5 High
- patrickjuchli basic-ftpbasic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)8.2 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule...5.9 Medium
- alexcorvi anchormeanchorme through 3.0.8 Regular Expression Denial of Service8.7 High
- red hat enterprise linux 6Dash: dash: super-polynomial backtracking in pmatch when libc fnmatch is disabled5.5 Medium
ruby-llmUbuntucrmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time...7.5 High- jpadilla pyjwtPyJWT: ReDoS vulnerability when calling the `is_pem_format` function.4.4 Medium
- axiosAxios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location8.2 High
- axiosAxios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)8.2 High
- nodemailernodemailer before 10.0.6 Denial of Service via addressparser8.7 High
- gerritRegular Expression Denial of Service (ReDoS) in Search Query Predicates and REST Filter Endpoints in Gerrit Code Review8.7 High
- habiticaHabitica: Regex Injection / ReDoS in Member Search6.5 Medium
- jline jline3JLine: ReDoS in Built-in Less Viewer Search7.5 High
- jline jline3JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable5.5 Medium
- jline jline3JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping7.5 High
- jline jline3JLine: ReDoS in Nano Editor Regex Search Mode6.5 Medium
- fasterxml jackson-corejackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS7.5 High
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Consecutive topic wildcards cause combinatorial routing work7.1 High
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard2.3 Low
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: ReDoS via management API ?name= filter6.0 Medium
- devolutions serverSync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`6.5 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an Unbounded LIKE Regular Expression6.0 Medium
- mongodb mongoidDenial of service via unbounded regex matching in Mongoid's in-memory query matcher8.7 High
- facelessuser soupsieveSoup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)5.3 Medium
- facelessuser soupsieveSoup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns5.3 Medium
- vendurehq vendureVendure: Unauthenticated ReDoS via `regex` filter on SQLite backends7.5 High
- hapijs joiJoi before 17.13.7 and 18.2.6 ReDoS via isoDate8.7 High
- a2ui-project a2uia2ui-project a2ui Basic Catalog safe_regex.ts redos6.9 Medium
- opencti-platform openctiOpenCTI: User-Controlled ReDoS in JSON Ingestion Mapper7.1 High
- apache opennlpApache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns10.0 Critical
- fasterxml jackson-databindjackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service7.5 High
- apache artemis, apache software foundation activemq artemis +1 moreApache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service6.5 Medium
- gitpython-developers gitpythonGitPython before 3.1.60 Denial of Service via ReDoS8.7 High
- n8n-io n8nn8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path7.1 High
@tiptap/corenpm,@rootio/tiptap__coreRoot +1 moreTiptap: Quadratic ReDoS in block and inline Markdown attribute parsing8.7 High- geopygeopy: Regular Expression Denial of Service (ReDoS) in geopy.Point4.0 Medium
- microsoft colordColord: Slow rejection of oversized malformed color strings6.9 Medium
- mozilla thunderbirdAllowed UNC hostnames for attachments interpreted as a regular expression7.5 High
- @xmldom xmldomxmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser8.7 High
- @xmldom xmldomxmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions8.7 High
- nltkNLTK before 3.10.3 Regular Expression Denial of Service via Pl196xCorpusReader6.3 Medium
- nltkNLTK 3.10.2 Regular Expression Denial of Service via tgrep8.2 High
- nltkNLTK before 3.10.0 ReDoS via Text.findall() unvalidated regex8.7 High
- sap se s/4hana (manage supply protection)Denial of Service (DoS) in SAP S/4HANA (Manage Supply Protection)7.5 High
- bluewave-labs checkmateCheckmate: Regular Expression Denial of Service (ReDoS) via User-Controlled Regex in Monitor Advanced Matching4.9 Medium
- Show moreLoading…