CWE-1333— Inefficient Regular Expression Complexity (ReDoS)

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.— MITRE CWE catalog

608 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-1333page 6 of 13

CVE-2022-40023HIGHCVSS 7.5EG 7.5
2022-09-07
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
CVE-2022-29158HIGHCVSS 7.5EG 7.5
2022-09-02
Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jir…
CVE-2022-36034HIGHCVSS 7.5EG 7.5
2022-08-29
nitrado.js is a type safe wrapper for the Nitrado API. Possible ReDoS with lib input of `{{` and with many repetitions of `{{|`. This issue has been patched in all versions above `0.2.5`. There are currently no known workarounds.
CVE-2022-35923HIGHCVSS 7.5EG 7.5
2022-08-02
v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and `uppercase()` regex which could lead to a denial of service attack. In testing …
CVE-2022-31147HIGHCVSS 7.5EG 7.5
2022-07-14
The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service (ReDoS) when an attacker is able to supply arbitra…
CVE-2022-31781HIGHCVSS 7.5EG 7.5
2022-07-13
Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete…
CVE-2022-31129HIGHCVSS 7.5EG 7.5
2022-07-06
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more spec…
CVE-2021-40901HIGHCVSS 7.5EG 7.5
2022-06-27
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scniro-validator v1.0.1 when validating crafted invalid emails.
CVE-2021-40900HIGHCVSS 7.5EG 7.5
2022-06-27
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in regexfn v1.0.5 when validating crafted invalid emails.
CVE-2021-40899HIGHCVSS 7.5EG 7.5
2022-06-27
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in repo-git-downloader v0.1.1 when downloading crafted invalid git repositories.
CVE-2021-40898HIGHCVSS 7.5EG 7.5
2022-06-27
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scaffold-helper v1.2.0 when copying crafted invalid files.
CVE-2021-40897HIGHCVSS 7.5EG 7.5
2022-06-27
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in split-html-to-chars v1.0.5 when splitting crafted invalid htmls.
CVE-2021-40896HIGHCVSS 7.5EG 7.5
2022-06-27
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in that-value v0.1.3 when validating crafted invalid emails.
CVE-2021-40895HIGHCVSS 7.5EG 7.5
2022-06-27
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in todo-regex v0.1.1 when matching crafted invalid TODO statements.
CVE-2021-40894HIGHCVSS 7.5EG 7.5
2022-06-24
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in underscore-99xp v1.7.2 when the deepValueSearch function is called.
CVE-2021-40893HIGHCVSS 7.5EG 7.5
2022-06-24
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-data v0.1.1 when validating crafted invalid emails.
CVE-2021-40892HIGHCVSS 7.5EG 7.5
2022-06-24
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-color v2.1.0 when handling crafted invalid rgb(a) strings.
CVE-2021-40660HIGHCVSS 7.5EG 7.5
2022-06-14
An issue was discovered in Delight Nashorn Sandbox 0.2.0. There is an ReDoS vulnerability that can be exploited to launching a denial of service (DoS) attack.
CVE-2022-29169HIGHCVSS 7.5EG 7.5
2022-06-01
BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnerable to regular expression denial of service (ReDoS) attacks. By using specific a RegularExpression,…
CVE-2022-26650HIGHCVSS 7.5EG 7.5
2022-05-17
In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious…
CVE-2022-24836HIGHCVSS 7.5EG 7.5
2022-04-11
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised…
CVE-2022-25598HIGHCVSS 7.5EG 7.5
2022-03-30
Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.
CVE-2022-24713HIGHCVSS 7.5EG 7.5
2022-03-08
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (…
CVE-2022-21681HIGHCVSS 7.5EG 7.5
2022-01-14
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted mark…
CVE-2022-21680HIGHCVSS 7.5EG 7.5
2022-01-14
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untr…
CVE-2021-3842HIGHCVSS 7.5EG 7.5
2022-01-04
nltk is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-41817HIGHCVSS 7.5EG 7.5
2022-01-01
Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.
CVE-2021-23490HIGHCVSS 7.5EG 7.5
2021-12-24
The package parse-link-header before 2.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the checkHeader function.
CVE-2021-45470HIGHCVSS 7.5EG 7.5
2021-12-23
lib/DatabaseLayer.py in cve-search before 4.1.0 allows regular expression injection, which can lead to ReDoS (regular expression denial of service) or other impacts.
CVE-2021-43805HIGHCVSS 7.5EG 7.5
2021-12-07
Solidus is a free, open-source ecommerce platform built on Rails. Versions of Solidus prior to 3.1.4, 3.0.4, and 2.11.13 have a denial of service vulnerability that could be exploited during a guest checkout. The regular expression used to…
CVE-2021-3765HIGHCVSS 7.5EG 7.5
2021-11-02
validator.js is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-42836HIGHCVSS 7.5EG 7.5
2021-10-22
GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.
CVE-2021-23446HIGHCVSS 7.5EG 7.5
2021-09-29
The package handsontable before 10.0.0; the package handsontable from 0 and before 10.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) in Handsontable.helper.isNumeric function.
CVE-2021-3828HIGHCVSS 7.5EG 7.5
2021-09-27
nltk is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3822HIGHCVSS 7.5EG 7.5
2021-09-27
jsoneditor is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3820HIGHCVSS 7.5EG 7.5
2021-09-27
inflect is vulnerable to Inefficient Regular Expression Complexity
CVE-2020-23478HIGHCVSS 7.5EG 7.5
2021-09-22
Leo Editor v6.2.1 was discovered to contain a regular expression denial of service (ReDoS) vulnerability in the component plugins/importers/dart.py.
CVE-2021-32838HIGHCVSS 7.5EG 7.5
2021-09-20
Flask-RESTX (pypi package flask-restx) is a community driven fork of Flask-RESTPlus. Flask-RESTX before version 0.5.1 is vulnerable to ReDoS (Regular Expression Denial of Service) in email_regex. This is fixed in version 0.5.1.
CVE-2021-3810HIGHCVSS 7.5EG 7.5
2021-09-17
code-server is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3807HIGHCVSS 7.5EG 7.5
2021-09-17
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3804HIGHCVSS 7.5EG 7.5
2021-09-17
taro is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3803HIGHCVSS 7.5EG 7.5
2021-09-17
nth-check is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3795HIGHCVSS 7.5EG 7.5
2021-09-15
semver-regex is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3794HIGHCVSS 7.5EG 7.5
2021-09-15
vuelidate is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3777HIGHCVSS 7.5EG 7.5
2021-09-15
nodejs-tmpl is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3749HIGHCVSS 7.5EG 7.5
2021-08-31
axios is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3649HIGHCVSS 7.5EG 7.5
2021-07-16
chatwoot is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-32740HIGHCVSS 7.5EG 7.5
2021-07-06
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template im…
CVE-2020-1920HIGHCVSS 7.5EG 7.5
2021-06-01
A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed …
CVE-2021-33502HIGHCVSS 7.5EG 7.5
2021-05-24
The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

Map vulnerabilities like CWE-1333 to your infrastructure

EchelonGraph correlates every CVE — across CWE-1333 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →