CWE-1333
AllowedInefficient Regular Expression Complexity
Abstraction: Base · Status: Draft
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
724 vulnerabilities reference this CWE, most recent first.
GHSA-QFH9-8P57-MJJJ
Vulnerability from github – Published: 2023-06-12 15:30 – Updated: 2023-06-12 18:55The git-url-parse crate through 0.4.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to normalize_url in lib.rs, a similar issue to CVE-2023-32758 (Python).
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "git-url-parse"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.4.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-33290"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2023-06-12T18:55:56Z",
"nvd_published_at": "2023-06-12T13:15:10Z",
"severity": "LOW"
},
"details": "The git-url-parse crate through 0.4.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to `normalize_url` in `lib.rs`, a similar issue to CVE-2023-32758 (Python).",
"id": "GHSA-qfh9-8p57-mjjj",
"modified": "2023-06-12T18:55:56Z",
"published": "2023-06-12T15:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33290"
},
{
"type": "WEB",
"url": "https://github.com/tjtelan/git-url-parse-rs/issues/51"
},
{
"type": "PACKAGE",
"url": "https://github.com/tjtelan/git-url-parse-rs"
},
{
"type": "WEB",
"url": "https://github.com/tjtelan/git-url-parse-rs/blob/main/src/lib.rs#L396"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "git-url-parse crate vulnerable to Regular Expression Denial of Service"
}
GHSA-QFPG-MW2P-44HG
Vulnerability from github – Published: 2025-08-13 18:31 – Updated: 2025-08-13 18:31An issue has been discovered in GitLab CE/EE affecting all versions from 13.2 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to create a denial of service condition by sending specially crafted markdown payloads to the Wiki feature.
{
"affected": [],
"aliases": [
"CVE-2025-2937"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-13T18:15:31Z",
"severity": "MODERATE"
},
"details": "An issue has been discovered in GitLab CE/EE affecting all versions from 13.2 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to create a denial of service condition by sending specially crafted markdown payloads to the Wiki feature.",
"id": "GHSA-qfpg-mw2p-44hg",
"modified": "2025-08-13T18:31:25Z",
"published": "2025-08-13T18:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2937"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/3058879"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/528995"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QFR5-WJPW-Q4C4
Vulnerability from github – Published: 2022-06-19 00:00 – Updated: 2022-06-29 21:52python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. By sending crafted regex input, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "python-ldap"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-46823"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-20T22:36:32Z",
"nvd_published_at": "2022-06-18T16:15:00Z",
"severity": "MODERATE"
},
"details": "python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. By sending crafted regex input, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition.",
"id": "GHSA-qfr5-wjpw-q4c4",
"modified": "2022-06-29T21:52:17Z",
"published": "2022-06-19T00:00:21Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/python-ldap/python-ldap/security/advisories/GHSA-r8wq-qrxc-hmcm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46823"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/221507"
},
{
"type": "PACKAGE",
"url": "https://github.com/python-ldap/python-ldap"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Denial of Service in python-ldap"
}
GHSA-QG2F-7W4R-25F2
Vulnerability from github – Published: 2026-02-27 15:34 – Updated: 2026-02-27 15:34A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.
{
"affected": [],
"aliases": [
"CVE-2025-10990"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-27T14:16:27Z",
"severity": "HIGH"
},
"details": "A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (\u0026#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.",
"id": "GHSA-qg2f-7w4r-25f2",
"modified": "2026-02-27T15:34:19Z",
"published": "2026-02-27T15:34:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10990"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:17606"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:17613"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:17693"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-10990"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2398216"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QG54-694P-WGPP
Vulnerability from github – Published: 2021-11-16 00:32 – Updated: 2024-01-24 19:18Date’s parsing methods including Date.parse are using Regexps internally, some of which are vulnerable against regular expression denial of service. Applications and libraries that apply such methods to untrusted input may be affected.
The fix limits the input length up to 128 bytes by default instead of changing the regexps. This is because Date gem uses many Regexps and it is possible that there are still undiscovered vulnerable Regexps. For compatibility, it is allowed to remove the limitation by explicitly passing limit keywords as nil like Date.parse(str, limit: nil), but note that it may take a long time to parse.
Please update the date gem to version 3.2.1, 3.1.2, 3.0.2, and 2.0.1, or later. You can use gem update date to update it. If you are using bundler, please add gem "date", ">= 3.2.1" to your Gemfile. If you import date from the standard library rather than as a gem you should update your Ruby install to 3.0.3, 2.7.5, 2.6.9 or later.
Users unable to upgrade may consider using Date.strptime instead with a predefined date format
Date.strptime('2001-02-20', '%Y-%m-%d')
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "date"
},
"ranges": [
{
"events": [
{
"introduced": "3.2.0"
},
{
"fixed": "3.2.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "date"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.0"
},
{
"fixed": "3.1.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "date"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "date"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-41817"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2021-11-16T00:15:43Z",
"nvd_published_at": "2022-01-01T05:15:00Z",
"severity": "HIGH"
},
"details": "Date\u2019s parsing methods including Date.parse are using Regexps internally, some of which are vulnerable against regular expression denial of service. Applications and libraries that apply such methods to untrusted input may be affected.\n\nThe fix limits the input length up to 128 bytes by default instead of changing the regexps. This is because Date gem uses many Regexps and it is possible that there are still undiscovered vulnerable Regexps. For compatibility, it is allowed to remove the limitation by explicitly passing limit keywords as nil like Date.parse(str, limit: nil), but note that it may take a long time to parse.\n\nPlease update the date gem to version 3.2.1, 3.1.2, 3.0.2, and 2.0.1, or later. You can use gem update date to update it. If you are using bundler, please add gem \"date\", \"\u003e= 3.2.1\" to your Gemfile. If you import `date` from the standard library rather than as a gem you should update your Ruby install to `3.0.3`, `2.7.5`, `2.6.9` or later.\n\nUsers unable to upgrade may consider using `Date.strptime` instead with a predefined date format\n```ruby\nDate.strptime(\u00272001-02-20\u0027, \u0027%Y-%m-%d\u0027)\n```",
"id": "GHSA-qg54-694p-wgpp",
"modified": "2024-01-24T19:18:37Z",
"published": "2021-11-16T00:32:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41817"
},
{
"type": "WEB",
"url": "https://github.com/ruby/date/commit/3959accef8da5c128f8a8e2fd54e932a4fb253b0"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/1254844"
},
{
"type": "PACKAGE",
"url": "https://github.com/ruby/date"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/date/CVE-2021-41817.yml"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IUXQCH6FRKANCVZO2Q7D2SQX33FP3KWN"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTOJGS5IEFDK3UOO7IY4OTTFGHGLSWZF"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202401-27"
},
{
"type": "WEB",
"url": "https://www.ruby-lang.org/en/news/2021/11/15/date-parsing-method-regexp-dos-cve-2021-41817"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Regular expression denial of service vulnerability (ReDoS) in date"
}
GHSA-QG5X-66HP-CW5P
Vulnerability from github – Published: 2022-03-31 00:00 – Updated: 2022-04-05 18:52Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks. Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.dolphinscheduler:dolphinscheduler"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "apache-dolphinscheduler"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-25598"
],
"database_specific": {
"cwe_ids": [
"CWE-1333",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2022-04-01T15:38:43Z",
"nvd_published_at": "2022-03-30T10:15:00Z",
"severity": "HIGH"
},
"details": "Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks. Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.",
"id": "GHSA-qg5x-66hp-cw5p",
"modified": "2022-04-05T18:52:26Z",
"published": "2022-03-31T00:00:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25598"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/dolphinscheduler"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/apache-dolphinscheduler/PYSEC-2022-176.yaml"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/hwnw7xr969sg5nv84wz75nfr2c76fl93"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Uncontrolled Resource Consumption in Apache DolphinScheduler"
}
GHSA-QGMG-GPPG-76G5
Vulnerability from github – Published: 2021-11-03 17:34 – Updated: 2021-11-03 14:46validator.js prior to 13.7.0 is vulnerable to Inefficient Regular Expression Complexity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "validator"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-3765"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2021-11-03T14:46:00Z",
"nvd_published_at": "2021-11-02T07:15:00Z",
"severity": "MODERATE"
},
"details": "validator.js prior to 13.7.0 is vulnerable to Inefficient Regular Expression Complexity",
"id": "GHSA-qgmg-gppg-76g5",
"modified": "2021-11-03T14:46:00Z",
"published": "2021-11-03T17:34:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3765"
},
{
"type": "WEB",
"url": "https://github.com/validatorjs/validator.js/commit/496fc8b2a7f5997acaaec33cc44d0b8dba5fb5e1"
},
{
"type": "PACKAGE",
"url": "https://github.com/validatorjs/validator.js"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/c37e975c-21a3-4c5f-9b57-04d63b28cfc9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "Inefficient Regular Expression Complexity in validator.js"
}
GHSA-QHV9-728R-6JQG
Vulnerability from github – Published: 2018-10-10 18:57 – Updated: 2021-09-16 19:58Affected versions of tough-cookie may be vulnerable to regular expression denial of service when long strings of semicolons exist in the Set-Cookie header.
Recommendation
Update to version 2.3.0 or later.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "tough-cookie"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-1000232"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:52:05Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "Affected versions of `tough-cookie` may be vulnerable to regular expression denial of service when long strings of semicolons exist in the `Set-Cookie` header.\n\n\n## Recommendation\n\nUpdate to version 2.3.0 or later.",
"id": "GHSA-qhv9-728r-6jqg",
"modified": "2021-09-16T19:58:53Z",
"published": "2018-10-10T18:57:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1000232"
},
{
"type": "WEB",
"url": "https://github.com/salesforce/tough-cookie/commit/615627206357d997d5e6ff9da158997de05235ae"
},
{
"type": "WEB",
"url": "https://github.com/salesforce/tough-cookie/commit/e4fc2e0f9ee1b7a818d68f0ac7ea696f377b1534"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:2101"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2912"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/cve-2016-1000232"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-qhv9-728r-6jqg"
},
{
"type": "PACKAGE",
"url": "https://github.com/salesforce/tough-cookie"
},
{
"type": "WEB",
"url": "https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-api-connect-is-affected-by-node-js-tough-cookie-module-vulnerability-to-a-denial-of-service-cve-2016-1000232"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/130"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "ReDoS via long string of semicolons in tough-cookie"
}
GHSA-QJM7-55VV-3C5F
Vulnerability from github – Published: 2023-01-18 03:31 – Updated: 2026-02-17 22:04A vulnerability was found in melnaron mel-spintax. It has been rated as problematic. Affected by this issue is some unknown functionality of the file lib/spintax.js. The manipulation of the argument text leads to inefficient regular expression complexity. The name of the patch is 37767617846e27b87b63004e30216e8f919637d3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218456.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "mel-spintax"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-25077"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2023-01-20T23:35:16Z",
"nvd_published_at": "2023-01-18T01:15:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in melnaron mel-spintax. It has been rated as problematic. Affected by this issue is some unknown functionality of the file `lib/spintax.js`. The manipulation of the argument text leads to inefficient regular expression complexity. The name of the patch is 37767617846e27b87b63004e30216e8f919637d3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218456.",
"id": "GHSA-qjm7-55vv-3c5f",
"modified": "2026-02-17T22:04:14Z",
"published": "2023-01-18T03:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25077"
},
{
"type": "WEB",
"url": "https://github.com/melnaron/mel-spintax/commit/37767617846e27b87b63004e30216e8f919637d3"
},
{
"type": "PACKAGE",
"url": "https://github.com/melnaron/mel-spintax"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.218456"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "mel-spintax has Inefficient Regular Expression Complexity"
}
GHSA-QJVX-7F9V-7WFV
Vulnerability from github – Published: 2024-06-06 21:30 – Updated: 2024-06-06 21:30kubeflow/kubeflow is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to inefficient regular expression complexity in its email validation mechanism. An attacker can remotely exploit this vulnerability without authentication by providing specially crafted input that causes the application to consume an excessive amount of CPU resources. This vulnerability affects the latest version of kubeflow/kubeflow, specifically within the centraldashboard-angular backend component. The impact of exploiting this vulnerability includes resource exhaustion, and service disruption.
{
"affected": [],
"aliases": [
"CVE-2024-5552"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-06T19:16:09Z",
"severity": "HIGH"
},
"details": "kubeflow/kubeflow is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to inefficient regular expression complexity in its email validation mechanism. An attacker can remotely exploit this vulnerability without authentication by providing specially crafted input that causes the application to consume an excessive amount of CPU resources. This vulnerability affects the latest version of kubeflow/kubeflow, specifically within the centraldashboard-angular backend component. The impact of exploiting this vulnerability includes resource exhaustion, and service disruption.",
"id": "GHSA-qjvx-7f9v-7wfv",
"modified": "2024-06-06T21:30:38Z",
"published": "2024-06-06T21:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5552"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/0c1d6432-f385-4c54-beea-9f8c677def5b"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
Mitigation
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Mitigation
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
Mitigation
Limit the length of the input that the regular expression will process.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.