CWE-1333— Inefficient Regular Expression Complexity (ReDoS)

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.— MITRE CWE catalog

608 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-1333page 7 of 13

CVE-2021-27291HIGHCVSS 7.5EG 7.5
2021-03-17
In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting …
CVE-2021-28092HIGHCVSS 7.5EG 7.5
2021-03-12
The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker provides a malicious string, is-svg will get stuck processing the input for a v…
CVE-2021-26813HIGHCVSS 7.5EG 7.5
2021-03-03
markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an extended period of time.
CVE-2019-0820HIGHCVSS 7.5EG 7.5
2019-05-16
A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.
CVE-2019-12041HIGHCVSS 7.5EG 7.5
2019-05-13
lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section.
CVE-2018-20801HIGHCVSS 7.5EG 7.5
2019-03-14
In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS.
CVE-2017-18077HIGHCVSS 7.5EG 7.5
2018-01-27
index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as demonstrated by an expand argument containing many comma characters.
CVE-2015-8858HIGHCVSS 7.5EG 7.5
2017-01-23
The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a "regular expression denial of service (ReDoS)."
CVE-2015-8855HIGHCVSS 7.5EG 7.5
2017-01-23
The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."
CVE-2015-8854HIGHCVSS 7.5EG 7.5
2017-01-23
The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular expression denial o…
CVE-2015-8315HIGHCVSS 7.5EG 7.5
2017-01-23
The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."
CVE-2016-2515HIGHCVSS 7.5EG 7.5
2016-04-13
Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long (1) header or (2) URI that is matched against an improper regular expression.
CVE-2016-2537HIGHCVSS 7.5EG 7.5
2016-02-23
The is-my-json-valid package before 2.12.4 for Node.js has an incorrect exports['utc-millisec'] regular expression, which allows remote attackers to cause a denial of service (blocked event loop) via a crafted string.
CVE-2024-1892HIGHCVSS 6.5EG 7.5
2024-02-28
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML content that exploits inefficient regular ex…
CVE-2022-1510HIGHCVSS 6.5EG 7.5
2022-05-11
An issue has been discovered in GitLab affecting all versions starting from 13.9 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly handling malicious tex…
CVE-2021-32821HIGHCVSS 6.2EG 7.5
2023-01-03
MooTools is a collection of JavaScript utilities for JavaScript developers. All known versions include a CSS selector parser that is vulnerable to Regular Expression Denial of Service (ReDoS). An attack requires that an attacker can inject…
CVE-2022-40897HIGHCVSS 5.9EG 7.5
2022-12-23
Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_i…
CVE-2022-1929HIGHCVSS 5.9EG 7.5
2022-06-02
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to the certificateFor method
CVE-2024-45813HIGHCVSS 5.3EG 7.5
2024-09-18
find-my-way is a fast, open source HTTP router, internally using a Radix Tree (aka compact Prefix Tree), supports route params, wildcards, and it's framework independent. A bad regular expression is generated any time one has two parameter…
CVE-2022-25883HIGHCVSS 5.3EG 7.5
2023-06-21
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
CVE-2023-28756HIGHCVSS 5.3EG 7.5
2023-03-31
A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The…
CVE-2023-28755HIGHCVSS 5.3EG 7.5
2023-03-31
A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The f…
CVE-2022-25881HIGHCVSS 5.3EG 7.5
2023-01-31
This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
CVE-2022-25927HIGHCVSS 5.3EG 7.5
2023-01-26
Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.
CVE-2022-25918HIGHCVSS 5.3EG 7.5
2022-10-27
The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to the usage of insecure regex in the escapeArgBash function.
CVE-2022-42969HIGHCVSS 5.3EG 7.5
2022-10-16
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: …
CVE-2022-24373HIGHCVSS 5.3EG 7.5
2022-09-30
The package react-native-reanimated before 3.0.0-rc.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper usage of regular expression in the parser of Colors.js.
CVE-2022-21222HIGHCVSS 5.3EG 7.5
2022-09-30
The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered…
CVE-2022-25887HIGHCVSS 5.3EG 7.5
2022-08-30
The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.
CVE-2022-25858HIGHCVSS 5.3EG 7.5
2022-07-15
The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.
CVE-2022-25758HIGHCVSS 5.3EG 7.5
2022-07-01
All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of insecure regex.
CVE-2021-23354HIGHCVSS 5.3EG 7.5
2021-03-12
The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string /\%(?:$([\w_.]+)$|([1-9]\d*)\$)?([0 +\-\]*)(\*|\d+)?(\.)?(\*|\d+)?[hlL]?([\%bscdeEfFgGioOuxX])/g in lib/printf.js. The vu…
CVE-2021-21317HIGHCVSS 5.3EG 7.5
2021-02-16
uap-core in an open-source npm package which contains the core of BrowserScope's original user agent string parser. In uap-core before version 0.11.0, some regexes are vulnerable to regular expression denial of service (REDoS) due to overl…
CVE-2019-25103HIGHCVSS 4.3EG 7.5
2023-02-12
A vulnerability has been found in simple-markdown 0.5.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file simple-markdown.js. The manipulation leads to inefficient regular expression comp…
CVE-2019-25102HIGHCVSS 4.3EG 7.5
2023-02-12
A vulnerability, which was classified as problematic, was found in simple-markdown 0.6.0. Affected is an unknown function of the file simple-markdown.js. The manipulation with the input <<<<<<<<<<:/:/:/:/:/:/:/:/:/:/ leads to inefficient r…
CVE-2018-25079HIGHCVSS 4.3EG 7.5
2023-02-04
A vulnerability was found in Segmentio is-url up to 1.2.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. Th…
CVE-2021-4299HIGHCVSS 4.3EG 7.5
2023-01-02
A vulnerability classified as problematic was found in cronvel string-kit up to 0.12.7. This vulnerability affects the function naturalSort of the file lib/naturalSort.js. The manipulation leads to inefficient regular expression complexity…
CVE-2018-25061HIGHCVSS 4.3EG 7.5
2022-12-31
A vulnerability was found in rgb2hex up to 0.1.5. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to inefficient regular expression complexity. The attack may be initiated remotely. Upgr…
CVE-2020-36661HIGHCVSS 3.5EG 7.5
2023-02-12
A vulnerability was found in Kong lua-multipart 0.5.8-1. It has been declared as problematic. This vulnerability affects the function is_header of the file src/multipart.lua. The manipulation leads to inefficient regular expression complex…
CVE-2020-36649HIGHCVSS 3.5EG 7.5
2023-01-11
A vulnerability was found in mholt PapaParse up to 5.1.x. It has been classified as problematic. Affected is an unknown function of the file papaparse.js. The manipulation leads to inefficient regular expression complexity. Upgrading to ve…
CVE-2018-25074HIGHCVSS 3.5EG 7.5
2023-01-11
A vulnerability was found in Prestaul skeemas and classified as problematic. This issue affects some unknown processing of the file validators/base.js. The manipulation of the argument uri leads to inefficient regular expression complexity…
CVE-2017-20165HIGHCVSS 3.5EG 7.5
2023-01-09
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. U…
CVE-2021-4306HIGHCVSS 3.5EG 7.5
2023-01-07
A vulnerability classified as problematic has been found in cronvel terminal-kit up to 2.1.7. Affected is an unknown function. The manipulation leads to inefficient regular expression complexity. Upgrading to version 2.1.8 is able to addre…
CVE-2021-4305HIGHCVSS 3.5EG 7.5
2023-01-05
A vulnerability was found in Woorank robots-txt-guard. It has been rated as problematic. Affected by this issue is the function makePathPattern of the file lib/patterns.js. The manipulation of the argument pattern leads to inefficient regu…
CVE-2015-10005HIGHCVSS 3.5EG 7.5
2022-12-27
A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/html_re.js. The manipulation leads to inefficient regular expression complexity. Upgrading to…
CVE-2018-25049HIGHCVSS 3.0EG 7.5
2022-12-27
A vulnerability was found in email-existence. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The name of the…
CVE-2015-5145HIGHCVSS v2 7.8EG 7.5
2015-07-14
validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
CVE-2009-3695HIGHCVSS v2 5.0EG 7.5
2009-10-13
Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (…
CVE-2022-29167HIGHCVSS 7.4EG 7.4
2022-05-05
Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request …
CVE-2024-45801HIGHCVSS 7.3EG 7.3
2024-09-16
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It …

Map vulnerabilities like CWE-1333 to your infrastructure

EchelonGraph correlates every CVE — across CWE-1333 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →