CWE-777 Regular Expression without Anchors

variant

The product uses a regular expression to perform neutralization, but the regular expression is not anchored and may allow malicious or malformed data to slip through.

übergeordnete Schwächen

Übergeordnete Klassen, zu denen dies gehört.

CWE-625Permissive Regular Expression

Schwachstellen (6)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-40110US	high7.3	0.31% (24th)	—	2026-05-05
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against…
CVE-2026-22068US	medium5.3	0.61% (49th)	—	2026-07-29
Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14. Users…
CVE-2026-97736US	—	0.21% (11th)	—	2026-09-25
tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.
CVE-2026-56021US	—	0.48% (41st)	—	2026-06-18
Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.
CVE-2026-39087US	—	0.27% (19th)	—	2026-04-23
ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.
CVE-2024-1899US	—	0.81% (57th)	—	2024-02-26
An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions.

Quelle

Wo diese Definition veröffentlicht ist.

MITREUS

scry

Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan