CWE-1333
AllowedInefficient Regular Expression Complexity
Abstraction: Base · Status: Draft
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
822 vulnerabilities reference this CWE, most recent first.
GHSA-P4PJ-MG4R-X6V4
Vulnerability from github – Published: 2021-02-02 15:46 – Updated: 2024-02-08 22:17Impact
Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.
Patches
Please update uap-core to >= v0.11.0
Downstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "uap-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.11.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-21317"
],
"database_specific": {
"cwe_ids": [
"CWE-1333",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2021-02-01T16:57:05Z",
"nvd_published_at": "2021-02-16T18:15:00Z",
"severity": "HIGH"
},
"details": "## Impact\n\nSome regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.\n\n## Patches\n\nPlease update uap-core to \u003e= v0.11.0\n\nDownstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes.",
"id": "GHSA-p4pj-mg4r-x6v4",
"modified": "2024-02-08T22:17:20Z",
"published": "2021-02-02T15:46:38Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ua-parser/uap-core/security/advisories/GHSA-p4pj-mg4r-x6v4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21317"
},
{
"type": "WEB",
"url": "https://github.com/ua-parser/uap-core/commit/dc9925d458214cfe87b93e35346980612f6ae96c"
},
{
"type": "PACKAGE",
"url": "https://github.com/ua-parser/uap-core"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/uap-core"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Denial of Service in uap-core"
}
GHSA-P5WF-CMR4-XRWR
Vulnerability from github – Published: 2024-10-18 18:40 – Updated: 2024-11-01 21:47Impact
The CVE is for a software vulnerability. Network admins who have deployed tacquito (or versions of tacquito) in their production environments and use tacquito to perform command authorization for network devices should be impacted.
Tacquito code prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was performing regex matches on authorized commands and arguments in a more permissive than intended manner. Configured allowed commands/arguments were intended to require a match on the entire string, but instead only enforced a match on a sub-string. This behaviour could potentially allowed unauthorized commands to be executed.
Patches
The problem has been patched, and users should update to the latest github repo commit to get the patch.
Workarounds
Users should be able to add boundary conditions anchors '^' and '$' to their command configs to remediate the vulnerability without the upgrade
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/facebookincubator/tacquito"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.0-20241011192817-07b49d1358e6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2024-10-18T18:40:32Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\nThe CVE is for a software vulnerability. Network admins who have deployed tacquito (or versions of tacquito) in their production environments and use tacquito to perform command authorization for network devices should be impacted.\n\nTacquito code prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was performing regex matches on authorized commands and arguments in a more permissive than intended manner. Configured allowed commands/arguments were intended to require a match on the entire string, but instead only enforced a match on a sub-string. This behaviour could potentially allowed unauthorized commands to be executed.\n\n### Patches\nThe problem has been patched, and users should update to the latest github repo commit to get the patch. \n\n### Workarounds\nUsers should be able to add boundary conditions anchors \u0027^\u0027 and \u0027$\u0027 to their command configs to remediate the vulnerability without the upgrade\n",
"id": "GHSA-p5wf-cmr4-xrwr",
"modified": "2024-11-01T21:47:15Z",
"published": "2024-10-18T18:40:32Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/facebookincubator/tacquito/security/advisories/GHSA-p5wf-cmr4-xrwr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49400"
},
{
"type": "WEB",
"url": "https://github.com/facebookincubator/tacquito/commit/07b49d1358e6ec0b5aa482fcd284f509191119e2"
},
{
"type": "PACKAGE",
"url": "https://github.com/facebookincubator/tacquito"
},
{
"type": "WEB",
"url": "https://www.facebook.com/security/advisories/cve-2024-49400"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Permissive Regular Expression in tacquito"
}
GHSA-P6JQ-9GCC-MCVX
Vulnerability from github – Published: 2025-04-19 06:30 – Updated: 2025-04-21 03:30The WP-Syntax WordPress plugin through 1.2 does not properly handle input, allowing an attacker to create a post containing a large number of tags, thereby exploiting a catastrophic backtracking issue in the regular expression processing to cause a DoS.
{
"affected": [],
"aliases": [
"CVE-2024-13926"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-19T06:15:18Z",
"severity": "HIGH"
},
"details": "The WP-Syntax WordPress plugin through 1.2 does not properly handle input, allowing an attacker to create a post containing a large number of tags, thereby exploiting a catastrophic backtracking issue in the regular expression processing to cause a DoS.",
"id": "GHSA-p6jq-9gcc-mcvx",
"modified": "2025-04-21T03:30:18Z",
"published": "2025-04-19T06:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13926"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/b5f0092e-7cd5-412f-a8ea-7bd4a8bf86d2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-P6M5-H7PP-V2X5
Vulnerability from github – Published: 2022-05-02 03:47 – Updated: 2024-09-16 21:57Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.0"
},
{
"fixed": "1.0.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.1"
},
{
"fixed": "1.1.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2009-3695"
],
"database_specific": {
"cwe_ids": [
"CWE-1333",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-08T22:00:20Z",
"nvd_published_at": "2009-10-13T10:30:00Z",
"severity": "HIGH"
},
"details": "Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.",
"id": "GHSA-p6m5-h7pp-v2x5",
"modified": "2024-09-16T21:57:14Z",
"published": "2022-05-02T03:47:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3695"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/594a28a9044120bed58671dde8a805c9e0f6c79a"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/e3e992e18b368fcd56aabafc1b5bf80a6e11b495"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53727"
},
{
"type": "PACKAGE",
"url": "https://github.com/django/django"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2009-4.yaml"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20091013093057/http://secunia.com/advisories/36968"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20091017070244/http://secunia.com/advisories/36948"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200228171918/http://www.securityfocus.com/bid/36655"
},
{
"type": "WEB",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=550457"
},
{
"type": "WEB",
"url": "http://groups.google.com/group/django-users/browse_thread/thread/15df9e45118dfc51"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2009/dsa-1905"
},
{
"type": "WEB",
"url": "http://www.djangoproject.com/weblog/2009/oct/09/security"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2009/10/13/6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Django Regex Algorithmic Complexity Causes Denial of Service"
}
GHSA-P84V-45XJ-WWQJ
Vulnerability from github – Published: 2023-01-18 18:23 – Updated: 2025-02-18 22:36There is a possible regular expression based DoS vulnerability in Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2023-22792.
Versions Affected: >= 3.0.0 Not affected: < 3.0.0 Fixed Versions: 5.2.8.15 (Rails LTS), 6.1.7.1, 7.0.4.1 Impact
Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately. Releases
The FIXED releases are available at the normal locations. Workarounds
We recommend that all users upgrade to one of the FIXED versions. In the meantime, users can mitigate this vulnerability by using a load balancer or other device to filter out malicious X_FORWARDED_HOST headers before they reach the application. Patches
To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
6-1-Use-string-split-instead-of-regex-for-domain-parts.patch - Patch for 6.1 series
7-0-Use-string-split-instead-of-regex-for-domain-parts.patch - Patch for 7.0 series
Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "actionpack"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "5.2.8.15"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "actionpack"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.1.7.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "actionpack"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.4.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-22792"
],
"database_specific": {
"cwe_ids": [
"CWE-1333",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2023-01-18T18:23:34Z",
"nvd_published_at": "2023-02-09T20:15:00Z",
"severity": "LOW"
},
"details": "There is a possible regular expression based DoS vulnerability in Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2023-22792.\n\nVersions Affected: \u003e= 3.0.0 Not affected: \u003c 3.0.0 Fixed Versions: 5.2.8.15 (Rails LTS), 6.1.7.1, 7.0.4.1\nImpact\n\nSpecially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.\nReleases\n\nThe FIXED releases are available at the normal locations.\nWorkarounds\n\nWe recommend that all users upgrade to one of the FIXED versions. In the meantime, users can mitigate this vulnerability by using a load balancer or other device to filter out malicious X_FORWARDED_HOST headers before they reach the application.\nPatches\n\nTo aid users who aren\u2019t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.\n\n 6-1-Use-string-split-instead-of-regex-for-domain-parts.patch - Patch for 6.1 series\n 7-0-Use-string-split-instead-of-regex-for-domain-parts.patch - Patch for 7.0 series\n\nPlease note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.\n\nhttps://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released",
"id": "GHSA-p84v-45xj-wwqj",
"modified": "2025-02-18T22:36:28Z",
"published": "2023-01-18T18:23:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22792"
},
{
"type": "WEB",
"url": "https://discuss.rubyonrails.org/t/cve-2023-22792-possible-redos-based-dos-vulnerability-in-action-dispatch/82115"
},
{
"type": "PACKAGE",
"url": "https://github.com/rails/rails"
},
{
"type": "WEB",
"url": "https://github.com/rails/rails/releases/tag/v7.0.4.1"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2023-22792.yml"
},
{
"type": "WEB",
"url": "https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240202-0007"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5372"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "ReDoS based DoS vulnerability in Action Dispatch"
}
GHSA-P8PC-3F7W-JR5Q
Vulnerability from github – Published: 2024-10-26 21:30 – Updated: 2024-11-13 23:24Foundation is a front-end framework. Versions 6.3.3 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, it is unknown if any fixes are available.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "foundation-sites"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "6.3.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-26304"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2024-10-28T14:44:05Z",
"nvd_published_at": "2024-10-26T21:15:13Z",
"severity": "MODERATE"
},
"details": "Foundation is a front-end framework. Versions 6.3.3 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, it is unknown if any fixes are available.",
"id": "GHSA-p8pc-3f7w-jr5q",
"modified": "2024-11-13T23:24:36Z",
"published": "2024-10-26T21:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26304"
},
{
"type": "WEB",
"url": "https://github.com/foundation/foundation-sites/issues/12180"
},
{
"type": "PACKAGE",
"url": "https://github.com/foundation/foundation-sites"
},
{
"type": "ADVISORY",
"url": "https://securitylab.github.com/advisories/GHSL-2020-290-redos-foundation-sites"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green",
"type": "CVSS_V4"
}
],
"summary": "Foundation Regular Expression Denial of Service vulnerability"
}
GHSA-P9W8-2MPQ-49H9
Vulnerability from github – Published: 2023-02-04 06:30 – Updated: 2023-02-14 16:47A vulnerability was found in Segmentio is-url up to 1.2.2. It has been rated as problematic. Affected by this issue is an unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. Upgrading to version 1.2.3 is able to address this issue. The name of the patch is 149550935c63a98c11f27f694a7c4a9479e53794. It is recommended to upgrade the affected component. VDB-220058 is the identifier assigned to this vulnerability.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "is-url"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-25079"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2023-02-10T00:59:15Z",
"nvd_published_at": "2023-02-04T04:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability was found in Segmentio is-url up to 1.2.2. It has been rated as problematic. Affected by this issue is an unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. Upgrading to version 1.2.3 is able to address this issue. The name of the patch is 149550935c63a98c11f27f694a7c4a9479e53794. It is recommended to upgrade the affected component. VDB-220058 is the identifier assigned to this vulnerability.",
"id": "GHSA-p9w8-2mpq-49h9",
"modified": "2023-02-14T16:47:13Z",
"published": "2023-02-04T06:30:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25079"
},
{
"type": "WEB",
"url": "https://github.com/segmentio/is-url/pull/18"
},
{
"type": "WEB",
"url": "https://github.com/segmentio/is-url/commit/149550935c63a98c11f27f694a7c4a9479e53794"
},
{
"type": "PACKAGE",
"url": "https://github.com/segmentio/is-url"
},
{
"type": "WEB",
"url": "https://github.com/segmentio/is-url/releases/tag/v1.2.3"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.220058"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.220058"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "is-url Inefficient Regular Expression Complexity vulnerability"
}
GHSA-P9WX-2529-FP83
Vulnerability from github – Published: 2025-05-23 15:31 – Updated: 2025-05-27 15:03Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this vulnerability by providing specially crafted markdown input, such as deeply nested or repetitively structured brackets or tag attributes, which cause the parser to hang and lead to a Denial of Service.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "marked"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.17"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-25110"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2025-05-27T15:03:47Z",
"nvd_published_at": "2025-05-23T15:15:20Z",
"severity": "MODERATE"
},
"details": "Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in several regular expressions used for parsing HTML tags and markdown links. An attacker can exploit this vulnerability by providing specially crafted markdown input, such as deeply nested or repetitively structured brackets or tag attributes, which cause the parser to hang and lead to a Denial of Service.",
"id": "GHSA-p9wx-2529-fp83",
"modified": "2025-05-27T15:03:47Z",
"published": "2025-05-23T15:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25110"
},
{
"type": "WEB",
"url": "https://github.com/markedjs/marked/issues/1070"
},
{
"type": "WEB",
"url": "https://github.com/markedjs/marked/pull/1083"
},
{
"type": "WEB",
"url": "https://github.com/markedjs/marked/commit/20bfc106013ed45713a21672ad4a34df94dcd485"
},
{
"type": "WEB",
"url": "https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2018/CVE-2018-25110"
},
{
"type": "PACKAGE",
"url": "https://github.com/markedjs/marked"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Marked allows Regular Expression Denial of Service (ReDoS) attacks"
}
GHSA-PFQ8-RQ6V-VF5M
Vulnerability from github – Published: 2022-10-31 19:00 – Updated: 2025-06-11 17:34A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 because of the reCustomIgnore regular expression.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "html-minifier"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "4.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-37620"
],
"database_specific": {
"cwe_ids": [
"CWE-1333",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T23:06:37Z",
"nvd_published_at": "2022-10-31T12:15:00Z",
"severity": "HIGH"
},
"details": "A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 because of the reCustomIgnore regular expression.",
"id": "GHSA-pfq8-rq6v-vf5m",
"modified": "2025-06-11T17:34:37Z",
"published": "2022-10-31T19:00:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37620"
},
{
"type": "WEB",
"url": "https://github.com/kangax/html-minifier/issues/1135"
},
{
"type": "PACKAGE",
"url": "https://github.com/kangax/html-minifier"
},
{
"type": "WEB",
"url": "https://github.com/kangax/html-minifier/blob/51ce10f4daedb1de483ffbcccecc41be1c873da2/src/htmlminifier.js#L1338"
},
{
"type": "WEB",
"url": "https://github.com/kangax/html-minifier/blob/51ce10f4daedb1de483ffbcccecc41be1c873da2/src/htmlminifier.js#L294"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-HTMLMINIFIER-3091181"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "kangax html-minifier REDoS vulnerability"
}
GHSA-PFRM-4RJW-G9Q5
Vulnerability from github – Published: 2023-01-02 09:31 – Updated: 2023-01-10 16:13A vulnerability classified as problematic was found in cronvel string-kit up to 0.12.7. This vulnerability affects the function naturalSort of the file lib/naturalSort.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. Upgrading to version 0.12.8 can address this issue. The name of the patch is 9cac4c298ee92c1695b0695951f1488884a7ca73. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217180.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "string-kit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.12.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-4299"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2023-01-04T14:27:35Z",
"nvd_published_at": "2023-01-02T08:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability classified as problematic was found in cronvel string-kit up to 0.12.7. This vulnerability affects the function naturalSort of the file lib/naturalSort.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. Upgrading to version 0.12.8 can address this issue. The name of the patch is 9cac4c298ee92c1695b0695951f1488884a7ca73. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217180.",
"id": "GHSA-pfrm-4rjw-g9q5",
"modified": "2023-01-10T16:13:19Z",
"published": "2023-01-02T09:31:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4299"
},
{
"type": "WEB",
"url": "https://github.com/cronvel/string-kit/commit/9cac4c298ee92c1695b0695951f1488884a7ca73"
},
{
"type": "PACKAGE",
"url": "https://github.com/cronvel/string-kit"
},
{
"type": "WEB",
"url": "https://github.com/cronvel/string-kit/releases/tag/v0.12.8"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.217180"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.217180"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "string-kit Inefficient Regular Expression Complexity vulnerability"
}
Mitigation
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
Mitigation
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Mitigation
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
Mitigation
Limit the length of the input that the regular expression will process.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.