CWE-1333 Inefficient Regular Expression Complexity
baseThe product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (600)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-3364US | high7.5 | — | ||
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2… | ||||
| CVE-2022-24713US | high7.5 | Exploit | ||
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted rege… | ||||
| CVE-2024-8124US | high7.5 | — | ||
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.1.7, starting from 17.2 prior to 17.2.5, starting from 17.3 prior to 17.3.2 which cou… | ||||
| CVE-2021-3749US | high7.5 | Exploit | ||
axios is vulnerable to Inefficient Regular Expression Complexity | ||||
| CVE-2024-25126US | high7.5 | — | ||
Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible deni… | ||||
| CVE-2024-6232US | high7.5 | Exploit | ||
There is a MEDIUM severity vulnerability affecting CPython.
Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReD… | ||||
| CVE-2024-21490US | high7.5 | Exploit | ||
This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vu… | ||||
| CVE-2023-31606US | high7.5 | Exploit | ||
A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of S… | ||||
| CVE-2022-25927US | high7.5 | Exploit | ||
Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() funct… | ||||
| CVE-2017-20165US | high7.5 | Exploit | ||
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argumen… | ||||
| CVE-2022-31147US | high7.5 | Exploit | ||
The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of… | ||||
| CVE-2026-68749US | high7.5 | Exploit | ||
Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU via a long CS… | ||||
| CVE-2026-8888US | high7.5 | Exploit | ||
Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new RegExp() without compl… | ||||
| CVE-2025-25200US | high7.5 | Exploit | ||
Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-… | ||||
| CVE-2024-3651US | high7.5 | Exploit | ||
A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of cr… | ||||
| CVE-2023-43646US | high7.5 | Exploit | ||
get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial… | ||||
| CVE-2021-32837US | high7.5 | — | ||
mechanize, a library for automatically interacting with HTTP web servers, contains a regular expression that is vulnerable to regular expression denial of service (ReDoS) prior to… | ||||
| CVE-2020-28280US | critical9.8 | — | ||
Prototype pollution vulnerability in 'predefine' versions 0.0.0 through 0.1.2 allows an attacker to cause a denial of service and may lead to remote code execution. | ||||
| CVE-2026-82617US | critical9.8 | — | ||
The two built-in name-finder patterns exposed by
opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL
and DEFAULT_REGEX_NAME_FINDER.URL - contain ambiguo… | ||||
| CVE-2025-62484US | critical9.8 | — | ||
Inefficient regular expression complexity in certain Zoom Workplace Clients before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via networ… | ||||
03
Angriffsmuster (1)
CAPEC-Angriffsmuster, die dies ausnutzen.
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan