CWE-1333 Inefficient Regular Expression Complexity
baseThe product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (600)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-3364US | high7.5 | — | ||
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2… | ||||
| CVE-2022-24713US | high7.5 | Exploit | ||
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted rege… | ||||
| CVE-2024-8124US | high7.5 | — | ||
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.1.7, starting from 17.2 prior to 17.2.5, starting from 17.3 prior to 17.3.2 which cou… | ||||
| CVE-2021-3749US | high7.5 | Exploit | ||
axios is vulnerable to Inefficient Regular Expression Complexity | ||||
| CVE-2024-25126US | high7.5 | — | ||
Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible deni… | ||||
| CVE-2024-6232US | high7.5 | Exploit | ||
There is a MEDIUM severity vulnerability affecting CPython.
Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReD… | ||||
| CVE-2024-21490US | high7.5 | Exploit | ||
This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vu… | ||||
| CVE-2023-31606US | high7.5 | Exploit | ||
A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of S… | ||||
| CVE-2022-25927US | high7.5 | Exploit | ||
Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() funct… | ||||
| CVE-2017-20165US | high7.5 | Exploit | ||
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argumen… | ||||
| CVE-2022-31147US | high7.5 | Exploit | ||
The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of… | ||||
| CVE-2026-68749US | high7.5 | Exploit | ||
Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exhaust server CPU via a long CS… | ||||
| CVE-2026-8888US | high7.5 | Exploit | ||
Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new RegExp() without compl… | ||||
| CVE-2025-25200US | high7.5 | Exploit | ||
Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to parse the `X-Forwarded-… | ||||
| CVE-2024-3651US | high7.5 | Exploit | ||
A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of cr… | ||||
| CVE-2023-43646US | high7.5 | Exploit | ||
get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regular expression denial… | ||||
| CVE-2021-32837US | high7.5 | — | ||
mechanize, a library for automatically interacting with HTTP web servers, contains a regular expression that is vulnerable to regular expression denial of service (ReDoS) prior to… | ||||
| CVE-2020-28280US | critical9.8 | — | ||
Prototype pollution vulnerability in 'predefine' versions 0.0.0 through 0.1.2 allows an attacker to cause a denial of service and may lead to remote code execution. | ||||
| CVE-2026-82617US | critical9.8 | — | ||
The two built-in name-finder patterns exposed by
opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL
and DEFAULT_REGEX_NAME_FINDER.URL - contain ambiguo… | ||||
| CVE-2025-62484US | critical9.8 | — | ||
Inefficient regular expression complexity in certain Zoom Workplace Clients before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via networ… | ||||
03
attack patterns (1)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan