Weaknesses of type CWE-1333

366 results

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex com padrão mal construído que, em certos inputs, força o engine a testar bilhões de combinações antes de confirmar a rejeição. Isso consome CPU até paralisar o serviço, já que o tempo cresce exponencialmente com o tamanho da entrada.

Example

Uma validação de email como `(a+)+b` aplicada a uma string longa sem 'b' no final faz o engine tentar todas as combinações possíveis de agrupamento de 'a's antes de falhar — um input de 50 caracteres pode levar minutos para processar.

How to mitigate

Use ferramentas como `redos`, `regex-checker` ou testes de desempenho para validar regexes antes do deploy. Para casos simples (email, URL), prefira validadores específicos em vez de regex; se usar regex, limite o tamanho da entrada e adicione timeouts no engine.

CVE-2023-3364HIGHInefficient Regular Expression Complexity in GitLabEPSS 44.5%CVE-2024-8124HIGHInefficient Regular Expression Complexity in GitLabEPSS 40.0%CVE-2024-25126MEDIUMRack ReDos in content type parsing (2nd degree polynomial)EPSS 35.4%CVE-2024-2651MEDIUMInefficient Regular Expression Complexity in GitLabEPSS 33.3%CVE-2021-32837HIGHmechanize vulnerable to ReDoSEPSS 28.9%CVE-2024-2829HIGHInefficient Regular Expression Complexity in GitLabEPSS 26.0%CVE-2021-3749HIGHInefficient Regular Expression Complexity in axios/axiosEPSS 8.5%CVE-2015-8315HIGHThe ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "reEPSS 6.8%CVE-2021-3807HIGHInefficient Regular Expression Complexity in chalk/ansi-regexEPSS 3.6%CVE-2022-24836HIGHInefficient Regular Expression Complexity in NokogiriEPSS 3.5%CVE-2023-36053HIGHIn Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regulaEPSS 3.0%CVE-2022-41323HIGHIn Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service atEPSS 2.8%CVE-2022-21680HIGHCubic catastrophic backtracking (ReDoS) in markedEPSS 2.8%CVE-2022-25883MEDIUMVersions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when EPSS 2.8%CVE-2022-21681HIGHExponential catastrophic backtracking (ReDoS) in markedEPSS 2.7%CVE-2023-28755MEDIUMA ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have speEPSS 2.6%CVE-2022-40897MEDIUMPython Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted packagEPSS 2.6%CVE-2022-26650—Apache ShenYu (incubating) Regular expression denial of serviceEPSS 2.6%CVE-2024-6232HIGHRegular-expression DoS when parsing TarFile headersEPSS 2.2%CVE-2021-3803HIGHInefficient Regular Expression Complexity in fb55/nth-checkEPSS 2.2%