CWE-186 Overly Restrictive Regular Expression
baseA regular expression is overly restrictive, which prevents dangerous values from being detected.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (5)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-21681US | high7.5 | — | ||
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead t… | ||||
| CVE-2022-21680US | high7.5 | — | ||
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular… | ||||
| CVE-2017-16114US | high7.5 | — | ||
The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds. | ||||
| CVE-2025-46821US | medium5.3 | — | ||
Envoy is a cloud-native edge/middle/service proxy. Prior to versions 1.34.1, 1.33.3, 1.32.6, and 1.31.8, Envoy's URI template matcher incorrectly excludes the `*` character from a… | ||||
| CVE-2026-47241US | — | — | ||
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a raw string argument which… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan