CWE-1333: Inefficient Regular Expression Complexity, page 11
Filter
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
What the weakness is: CWE-1333 at MITRE
Ask an AI about CWE-1333
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-1333: Inefficient Regular Expression Complexity and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/1333.html and https://cve.bz/cve/cwe/1333?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.5CVE-2021-40901EPSS 1.1%
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scniro-validator v1.0.1 when validating crafted invalid emails.
- 7.5CVE-2021-40900EPSS 1.1%
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in regexfn v1.0.5 when validating crafted invalid emails.
- 7.5CVE-2021-40899EPSS 1.2%
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in repo-git-downloader v0.1.1 when downloading crafted invalid git repositories.
- 7.5CVE-2021-40898EPSS 1.1%
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scaffold-helper v1.2.0 when copying crafted invalid files.
- 7.5CVE-2021-40897EPSS 1.1%
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in split-html-to-chars v1.0.5 when splitting crafted invalid htmls.
- 7.5CVE-2021-40896EPSS 1.1%
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in that-value v0.1.3 when validating crafted invalid emails.
- 7.5CVE-2021-40895EPSS 1.1%
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in todo-regex v0.1.1 when matching crafted invalid TODO statements.
- 7.5CVE-2021-40894EPSS 1.1%
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in underscore-99xp v1.7.2 when the deepValueSearch function is called.
- 7.5CVE-2021-40893EPSS 1.3%
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-data v0.1.1 when validating crafted invalid emails.
- 7.5CVE-2021-40892EPSS 1.2%
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-color v2.1.0 when handling crafted invalid rgb(a) strings.
- 6.5CVE-2021-46823EPSS 1.9%
python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. By sending crafted regex inp…
- 7.5CVE-2021-40660EPSS 1.0%
An issue was discovered in Delight Nashorn Sandbox 0.2.0. There is an ReDoS vulnerability that can be exploited to launching a denial of service (DoS) attack.
- 7.5CVE-2022-1929EPSS 0.6%
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to the certificateFor method
- 7.5CVE-2021-43308EPSS 1.1%
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function
- 7.5CVE-2021-43307EPSS 1.6%
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method
- 7.5CVE-2021-43306EPSS 1.5%
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method
- 7.5CVE-2022-29169EPSS 1.6%
BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnerable to regular expression denial of service (ReDoS) attacks. By using specific a RegularExpression,…
- 7.5CVE-2022-21195EPSS 1.4%
All versions of package url-regex are vulnerable to Regular Expression Denial of Service (ReDoS) which can cause the CPU usage to crash.
- 7.5CVE-2022-26650EPSS 2.7%
In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious…
- 7.5CVE-2022-1510EPSS 2.0%
An issue has been discovered in GitLab affecting all versions starting from 13.9 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly handling malicious tex…
- 7.5CVE-2022-29167EPSS 1.1%
Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request …
- 7.5CVE-2022-25844EPSS 4.9%
The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre wi…
- 7.5CVE-2022-24836EPSS 3.5%
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised…
- 7.5CVE-2022-25598EPSS 2.0%
Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.
- 7.5CVE-2022-24729EPSS 2.5%
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which c…
- 7.5CVE-2022-24713EPSS 14%
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (…
- 7.5CVE-2022-21681EPSS 2.8%
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted mark…
- 7.5CVE-2022-21680EPSS 2.9%
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untr…
- 5.3CVE-2022-21670EPSS 2.3%
markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no k…
- 7.5CVE-2021-3842EPSS 1.6%
nltk is vulnerable to Inefficient Regular Expression Complexity
- 7.5CVE-2021-41817EPSS 3.5%
Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.
- 7.5CVE-2021-23490EPSS 1.9%
The package parse-link-header before 2.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the checkHeader function.
- 7.5CVE-2021-45470EPSS 1.9%
lib/DatabaseLayer.py in cve-search before 4.1.0 allows regular expression injection, which can lead to ReDoS (regular expression denial of service) or other impacts.
- 7.5CVE-2021-43843EPSS 2.0%
jsx-slack is a package for building JSON objects for Slack block kit surfaces from JSX. The maintainers found the patch for CVE-2021-43838 in jsx-slack v4.5.1 is insufficient tfor protection from a Regular Expression Denial of Service (ReD…
- 7.5CVE-2021-43838EPSS 1.4%
jsx-slack is a library for building JSON objects for Slack Block Kit surfaces from JSX. In versions prior to 4.5.1 users are vulnerable to a regular expression denial-of-service (ReDoS) attack. If attacker can put a lot of JSX elements int…
- 6.5CVE-2021-39940EPSS 1.6%
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. GitLab Maven Package registry is vulnerable…
- 6.5CVE-2021-39933EPSS 1.5%
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression used for handling use…
- 7.5CVE-2021-43805EPSS 1.4%
Solidus is a free, open-source ecommerce platform built on Rails. Versions of Solidus prior to 3.1.4, 3.0.4, and 2.11.13 have a denial of service vulnerability that could be exploited during a guest checkout. The regular expression used to…
- 7.5CVE-2021-3765EPSS 1.8%
validator.js is vulnerable to Inefficient Regular Expression Complexity
- 6.5CVE-2021-41115EPSS 1.7%
Zulip is an open source team chat server. In affected versions Zulip allows organization administrators on a server to configure "linkifiers" that automatically create links from messages that users send, detected via arbitrary regular exp…
- 7.5CVE-2021-23446EPSS 3.0%
The package handsontable before 10.0.0; the package handsontable from 0 and before 10.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) in Handsontable.helper.isNumeric function.
- 7.5CVE-2021-3828EPSS 1.6%
nltk is vulnerable to Inefficient Regular Expression Complexity
- 7.5CVE-2021-3822EPSS 1.4%
jsoneditor is vulnerable to Inefficient Regular Expression Complexity
- 7.5CVE-2021-3820EPSS 1.2%
inflect is vulnerable to Inefficient Regular Expression Complexity
- 7.5CVE-2021-3810EPSS 1.3%
code-server is vulnerable to Inefficient Regular Expression Complexity
- 7.5CVE-2021-3807EPSS 3.6%
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
- 7.5CVE-2021-3804EPSS 1.3%
taro is vulnerable to Inefficient Regular Expression Complexity
- 7.5CVE-2021-3803EPSS 2.2%
nth-check is vulnerable to Inefficient Regular Expression Complexity
- 7.5CVE-2021-3795EPSS 1.5%
semver-regex is vulnerable to Inefficient Regular Expression Complexity
- 6.5CVE-2021-3801EPSS 1.0%
prism is vulnerable to Inefficient Regular Expression Complexity