CWE-777: Regular Expression without Anchors
Filter
The product uses a regular expression to perform neutralization, but the regular expression omits one or more anchors that may allow malicious or malformed data to slip through.
What the weakness is: CWE-777 at MITRE. All weaknesses
Ask an AI about CWE-777
Show the prompt
Explain CWE-777: Regular Expression without Anchors and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/777.html and https://cve.bz/cve/cwe/777?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 9.8CVE-2026-78191EPSS 0.5%
WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages. WebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anch…
- 5.4CVE-2026-97736EPSS 0.2%
tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression.
- 6.9CVE-2026-22068EPSS 0.6%
Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, whi…
- 6.9CVE-2026-56021EPSS 0.5%
Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.
- 7.6CVE-2026-40110EPSS 0.3%
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match(…
- 6.4CVE-2026-39087EPSS 0.3%
ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.