CWE-1333: Inefficient Regular Expression Complexity, page 12

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

What the weakness is: CWE-1333 at MITRE

1. 7.5CVE-2021-3794EPSS 1.2%2021-09-15

   vuelidate is vulnerable to Inefficient Regular Expression Complexity

2. 7.5CVE-2021-3777EPSS 1.3%2021-09-15

   nodejs-tmpl is vulnerable to Inefficient Regular Expression Complexity

3. 7.5CVE-2021-3749EPSS 8.5%2021-08-31

   axios is vulnerable to Inefficient Regular Expression Complexity

4. 7.5CVE-2021-3649EPSS 1.2%2021-07-16

   chatwoot is vulnerable to Inefficient Regular Expression Complexity

5. 7.5CVE-2020-1920EPSS 1.4%2021-06-01

   A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed …

6. 7.5CVE-2021-33502EPSS 1.7%2021-05-24

   The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

7. 5.3CVE-2021-23364EPSS 2.4%2021-04-28

   The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

8. 7.5CVE-2021-23382EPSS 2.6%2021-04-26

   The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* source…

9. 5.3CVE-2021-23362EPSS 3.6%2021-03-23

   The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-cas…

10. 6.5CVE-2021-25292EPSS 1.7%2021-03-19

    An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.

11. 7.5CVE-2021-27291EPSS 3.9%2021-03-17

    In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting …

12. 7.5CVE-2021-28092EPSS 2.0%2021-03-12

    The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker provides a malicious string, is-svg will get stuck processing the input for a v…

13. 7.5CVE-2021-23354EPSS 2.2%2021-03-12

    The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string /\%(?:\(([\w_.]+)\)|([1-9]\d*)\$)?([0 +\-\]*)(\*|\d+)?(\.)?(\*|\d+)?[hlL]?([\%bscdeEfFgGioOuxX])/g in lib/printf.js. The vu…

14. 7.5CVE-2021-26813EPSS 2.3%2021-03-03

    markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an extended period of time.

15. 5.3CVE-2021-21317EPSS 2.5%2021-02-16

    uap-core in an open-source npm package which contains the core of BrowserScope's original user agent string parser. In uap-core before version 0.11.0, some regexes are vulnerable to regular expression denial of service (REDoS) due to overl…

16. 7.5CVE-2020-5243EPSS 2.3%2020-02-21

    uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote…

17. 6.5CVE-2019-16215EPSS 1.2%2019-09-18

    The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into the server could send a crafted message causing the server to spend an effectively arbitrary amoun…

18. 7.5CVE-2019-12041EPSS 1.3%2019-05-13

    lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section.

19. 6.5CVE-2017-16021EPSS 1.3%2018-06-04

    uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. Thi…

20. 7.5CVE-2015-8854EPSS 4.4%2017-01-23

    The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular expression denial o…

21. 7.5CVE-2015-8315EPSS 7.0%2017-01-23

    The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."