Falhas do tipo CWE-1333

366 resultados

Expressão regular com complexidade exponencial (ReDoS)

A aplicação usa uma regex que, em certos padrões de entrada, causa backtracking excessivo e consome CPU de forma exponencial. O motor regex tenta múltiplas combinações de correspondência antes de falhar ou suceder, podendo travar a aplicação ou deixá-la lenta demais para responder.

Exemplo

Um validador de email com regex como `(a+)+b` recebe a string `aaaaaaaaaaaaaaaaaaaaX` (sem o caractere final esperado). O motor testa todas as combinações de agrupamento do `a` repetido, levando tempo exponencial em relação ao tamanho da entrada.

Como mitigar

Use bibliotecas de parsing ou validação especializadas em vez de regex complexas (ex: bibliotecas de email ou URL). Se regex for necessária, teste com inputs longos malformados, limpe a entrada antes, ou use engines regex com proteção contra backtracking (como a do Rust).

CVE-2022-37603HIGHA Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.EPSS 2.1%CVE-2017-20165LOWdebug-js debug node.js useColors redosEPSS 2.0%CVE-2022-31147HIGHjquery-validation ReDoS in url2 due to incomplete fix of CVE-2021-43306EPSS 2.0%CVE-2024-26146MEDIUMPossible Denial of Service Vulnerability in Rack Header ParsingEPSS 2.0%CVE-2022-25598—Apache DolphinScheduler user registration is vulnerable to ReDoS attacksEPSS 1.9%CVE-2021-43843MEDIUMInsufficient patch for Regular Expression Denial of Service (ReDoS) to jsx-slack v4.5.1EPSS 1.9%CVE-2024-21490HIGHThis affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split thEPSS 1.9%CVE-2022-31781—Regular Expression Denial of Service (ReDoS) in ContentType.java. (GHSL-2022-022)EPSS 1.9%CVE-2024-27351MEDIUMIn Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and thEPSS 1.9%CVE-2022-29158—Regular Expression Denial of Service (ReDoS) vulnerability in Apache OFBizEPSS 1.8%CVE-2021-41115MEDIUMRegular expression denial-of-service in ZulipEPSS 1.7%CVE-2022-25927MEDIUMVersions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression DenialEPSS 1.7%CVE-2023-26115MEDIUMAll versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regularEPSS 1.7%CVE-2023-22467HIGHluxon.js inefficient regular expression complexity vulnerabilityEPSS 1.7%CVE-2021-3828HIGHInefficient Regular Expression Complexity in nltk/nltkEPSS 1.7%CVE-2023-26117MEDIUMVersions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to tEPSS 1.7%CVE-2023-26118MEDIUMVersions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> elementEPSS 1.7%CVE-2023-26116MEDIUMVersions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility fuEPSS 1.7%CVE-2023-39174MEDIUMIn JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackersEPSS 1.7%CVE-2022-23514HIGHInefficient Regular Expression Complexity in LoofahEPSS 1.7%