CWE-185: Incorrect Regular Expression
The product specifies a regular expression in a way that causes data to be improperly matched or compared.
A kind of CWE-697 Incorrect Comparison.
From the CWE List. © The MITRE Corporation.
Newest
- mongodb c# driver Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder 7.1 High
- follow-redirects follow-redirects sensitiveHeaders regex escaping can expose credential headers 8.2 High
- mljar mercury Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass 10.0 Critical
- givanz vvveb Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field 7.6 High
- hashicorp consul, consul enterprise +1 more Consul vulnerable to an authorization bypass in the Connect service mesh 7.5 High
- cli GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching 2.1 Low
- withastro astro @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped 3.7 Low
- webmin Webmin information disclosure via regex pattern 6.9 Medium
- hono Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 5.3 Medium
- budibase Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker 6.5 Medium
- sensiolabs symfony Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection 2.3 Low
- github enterprise server Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypass 7.5 High
- linuxfoundation tekton pipelines, tektoncd pipeline +1 more Tekton Pipelines: VerificationPolicy regex pattern bypass via substring matching 6.5 Medium
- istio Istio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy Bypass 5.4 Medium
- openclaw OpenClaw < 2026.3.28 - Environment Variable Disclosure via jq $ENV Filter Bypass 7.1 High
- dicebear @dicebear/converter ensureSize() Vulnerable to SVG Dimension Capping Bypass via XML Comment Injection 7.5 High
- thephpleague commonmark league/commonmark has an embed extension allowed_domains bypass 6.3 Medium
- ldap-account-manager ldap account manager, ldapaccountmanager lam +1 more LAM has incorrect regular expression in PDF export component that allows user to upload files of any type 4.3 Medium
- @clerk fastify Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation 5.3 Medium
- naturalintelligence fast-xml-parser, red hat migration toolkit for applications 8, advanced cluster security 4.8 +11 more +13 more fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names 9.3 Critical
- litestar Litestar has an AllowedHosts validation bypass due to unescaped regex metacharacters in configured host patterns 6.5 Medium
- hono Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing 4.8 Medium
- rennf93 fastapi-guard, fastapi-guard fastapi guard +1 more fastapi-guard patch contains bypassable RegEx 7.8 High
- cisco enterprise chat and email A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow... 7.5 High
- mozilla firefox, thunderbird +1 more Unexpected GC during RegExp bailout processing 6.5 Medium
-
parse-urinpm,parseurinpm +1 more parse-uri Regular expression Denial of Service (ReDoS) 6.5 Medium - goauthentik authentik authentik has an insecure default configuration for OAuth2 Redirect URIs 7.9 High
-
org.openrefine.dependencies:butterflyMaven Butterfly's parseJSON, getJSON functions eval malicious input, leading to remote code execution (RCE) No score - getastra wp hardening, astrasecuritysuite wp hardening (discontinued) +1 more WP Hardening – Fix Your WordPress Security <= 1.2.6 - Unauthenticated Security Feature Bypass to Username Enumeration 5.3 Medium
- bitdefender endpoint security for linux, endpoint security, gravityzone +3 more +5 more Incorrect Regular Expression in GravityZone Update Server (VA-11465) 8.1 High
- otrs, otrs ag ((otrs)) community edition +1 more DoS attack using PostMaster filters 5.3 Medium
- restsharp Incorrect Regular Expression in RestSharp 7.5 High
- braces project braces Regular Expression Denial of Service (ReDoS) in braces 5.3 Medium
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 more Specially crafted regex query can cause DoS 6.5 Medium
- jenkins audit trail, jenkins project audit trail plugin +1 more Incorrect default pattern in Jenkins Audit Trail Plugin 5.3 Medium
- cisco ios, ios xe +1 more Cisco IOS and IOS XE Software Split DNS Denial of Service Vulnerability 8.6 High
- mholt papaparse mholt PapaParse papaparse.js redos 3.5 Low
- elastic kibana, oracle communications billing and revenue management, communications cloud native core network function cloud native environment +1 more +3 more Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An... 4.8 Medium
- glpi-project glpi bypass of manageRedirect in GLPI 6.1 Medium
- red hat openshift-ansible, redhat openshift container platform +1 more A flaw was found in openshift-ansible. OpenShift Container Platform (OCP) 3.11 is too permissive... 5.9 Medium
- istio Istio ReDoS Vulnerability 7.5 High
- artifex mujs An issue was discovered in Artifex MuJS 1.0.5. regcompx in regexp.c does not restrict regular... 9.8 Critical
- modsecurity owasp modsecurity core rule set An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST... 5.3 Medium
- modsecurity owasp modsecurity core rule set An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST... 5.3 Medium
- modsecurity owasp modsecurity core rule set An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST... 5.3 Medium
- modsecurity owasp modsecurity core rule set An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST... 5.3 Medium
- modsecurity owasp modsecurity core rule set An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST... 5.3 Medium
- highcharts Regular Expression Denial of Service in Acorn 7.5 High
- uaparser user agent parser-core uap-core Regular Expression Denial of Service issue 5.3 Medium
- ispconfig An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to... 7.8 High
- Show olderLoading…