Inefficient Regular Expression Complexity
CWE-1333
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
We track 263 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.6.
How this weakness is prevented
- Architecture and Design: Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
- System Configuration: Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
- Implementation: Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
- Implementation: Limit the length of the input that the regular expression will process.
Latest Inefficient Regular Expression Complexity vulnerabilities
- 7.5 High severity
sanitize-html: Inefficient Regular Expression Complexity
The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.
- 7.5 High severity
nitrado.js: Inefficient Regular Expression Complexity
nitrado.js is a type safe wrapper for the Nitrado API. Possible ReDoS with lib input of `{{` and with many repetitions of `{{|`. This issue has been patched in all versions above `0.2.5`. There are currently no known workarounds.
- 7.5 High severity
eth-account: Inefficient Regular Expression Complexity
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the eth-account PyPI package, when an attacker is able to supply arbitrary input to the encode_structured_data method
- 7.5 High severity
v8n: Inefficient Regular Expression Complexity
v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and `uppercase()` regex which could lead to a denial of service attack. In testing of the `lowercase()`
- 7.5 High severity
Mistune: Inefficient Regular Expression Complexity
In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking.
- 7.5 High severity
terser: Inefficient Regular Expression Complexity
The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.
- 7.5 High severity
jquery-validation: Inefficient Regular Expression Complexity
The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service (ReDoS) when an attacker is able to supply arbitrary input to the url2
- 7.5 High severity
Apache Tapestry: Inefficient Regular Expression Complexity
Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete. Specifically, this
- 7.5 High severity
moment: Inefficient Regular Expression Complexity
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 pars
- 7.5 High severity
scss-tokenizer: Inefficient Regular Expression Complexity
All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of insecure regex.
- 7.5 High severity
RSSHub: Inefficient Regular Expression Complexity
RSSHub is an open source, extensible RSS feed generator. In commits prior to 5c4177441417 passing some special values to the `filter` and `filterout` parameters can cause an abnormally high CPU. This results in an impact on the performance of the servers and R
- 7.5 High severity
devcert: Inefficient Regular Expression Complexity
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to the certificateFor method
- 7.5 High severity
bigbluebutton: Inefficient Regular Expression Complexity
BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnerable to regular expression denial of service (ReDoS) attacks. By using specific a RegularExpression, an attacker can caus
- 7.5 High severity
Apache ShenYu (incubating): Inefficient Regular Expression Complexity
In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions
- 7.5 High severity
GitLab: Inefficient Regular Expression Complexity
An issue has been discovered in GitLab affecting all versions starting from 13.9 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly handling malicious text in the CI Editor an
- 7.5 High severity
hawk: Inefficient Regular Expression Complexity
Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a
- 7.5 High severity
angular: Inefficient Regular Expression Complexity
The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value.
- 7.5 High severity
nokogiri: Inefficient Regular Expression Complexity
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogi
- 7.5 High severity
Apache DolphinScheduler: Inefficient Regular Expression Complexity
Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.
- 7.5 High severity
ckeditor4: Inefficient Regular Expression Complexity
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significan
- 7.5 High severity
regex: Inefficient Regular Expression Complexity
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations
- 7.5 High severity
marked: Inefficient Regular Expression Complexity
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulner
- 7.5 High severity
marked: Inefficient Regular Expression Complexity
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown throug