CWE-1333— Inefficient Regular Expression Complexity (ReDoS)

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.— MITRE CWE catalog

626 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-1333page 6 of 13

CVE-2020-26302HIGHCVSS 7.5EG 7.5
2022-12-22
is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). is.js uses a regex copy-pasted from a gist to validate URLs. Tr…
CVE-2022-23517HIGHCVSS 7.5EG 7.5
2022-12-14
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer < 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attemp…
CVE-2022-23514HIGHCVSS 7.5EG 7.5
2022-12-14
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah < 2.19.1 contains an inefficient regular expression that is susceptible to excessive backtracking when attempt…
CVE-2022-30122HIGHCVSS 7.5EG 7.5
2022-12-05
A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.
CVE-2022-42124HIGHCVSS 7.5EG 7.5
2022-11-15
ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through fix pack 18, 7.3 before update 4, and DXP 7.4 GA allows remote attackers to consume an excessive am…
CVE-2022-37620HIGHCVSS 7.5EG 7.5
2022-10-31
A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 because of the reCustomIgnore regular expression.
CVE-2022-3517HIGHCVSS 7.5EG 7.5
2022-10-17
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
CVE-2022-41323HIGHCVSS 7.5EG 7.5
2022-10-16
In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.
CVE-2022-37603HIGHCVSS 7.5EG 7.5
2022-10-14
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
CVE-2022-37599HIGHCVSS 7.5EG 7.5
2022-10-11
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.
CVE-2022-37259HIGHCVSS 7.5EG 7.5
2022-09-20
A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the string variable in babel.js.
CVE-2022-37260HIGHCVSS 7.5EG 7.5
2022-09-15
A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the input variable in main.js.
CVE-2022-37262HIGHCVSS 7.5EG 7.5
2022-09-15
A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the source and sourceWithComments variable in main.js.
CVE-2022-40023HIGHCVSS 7.5EG 7.5
2022-09-07
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
CVE-2022-29158HIGHCVSS 7.5EG 7.5
2022-09-02
Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jir…
CVE-2022-36034HIGHCVSS 7.5EG 7.5
2022-08-29
nitrado.js is a type safe wrapper for the Nitrado API. Possible ReDoS with lib input of `{{` and with many repetitions of `{{|`. This issue has been patched in all versions above `0.2.5`. There are currently no known workarounds.
CVE-2022-35923HIGHCVSS 7.5EG 7.5
2022-08-02
v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and `uppercase()` regex which could lead to a denial of service attack. In testing …
CVE-2022-31147HIGHCVSS 7.5EG 7.5
2022-07-14
The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service (ReDoS) when an attacker is able to supply arbitra…
CVE-2022-31781HIGHCVSS 7.5EG 7.5
2022-07-13
Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete…
CVE-2022-31129HIGHCVSS 7.5EG 7.5
2022-07-06
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more spec…
CVE-2021-40901HIGHCVSS 7.5EG 7.5
2022-06-27
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scniro-validator v1.0.1 when validating crafted invalid emails.
CVE-2021-40900HIGHCVSS 7.5EG 7.5
2022-06-27
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in regexfn v1.0.5 when validating crafted invalid emails.
CVE-2021-40899HIGHCVSS 7.5EG 7.5
2022-06-27
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in repo-git-downloader v0.1.1 when downloading crafted invalid git repositories.
CVE-2021-40898HIGHCVSS 7.5EG 7.5
2022-06-27
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scaffold-helper v1.2.0 when copying crafted invalid files.
CVE-2021-40897HIGHCVSS 7.5EG 7.5
2022-06-27
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in split-html-to-chars v1.0.5 when splitting crafted invalid htmls.
CVE-2021-40896HIGHCVSS 7.5EG 7.5
2022-06-27
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in that-value v0.1.3 when validating crafted invalid emails.
CVE-2021-40895HIGHCVSS 7.5EG 7.5
2022-06-27
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in todo-regex v0.1.1 when matching crafted invalid TODO statements.
CVE-2021-40894HIGHCVSS 7.5EG 7.5
2022-06-24
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in underscore-99xp v1.7.2 when the deepValueSearch function is called.
CVE-2021-40893HIGHCVSS 7.5EG 7.5
2022-06-24
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-data v0.1.1 when validating crafted invalid emails.
CVE-2021-40892HIGHCVSS 7.5EG 7.5
2022-06-24
A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-color v2.1.0 when handling crafted invalid rgb(a) strings.
CVE-2021-40660HIGHCVSS 7.5EG 7.5
2022-06-14
An issue was discovered in Delight Nashorn Sandbox 0.2.0. There is an ReDoS vulnerability that can be exploited to launching a denial of service (DoS) attack.
CVE-2022-29169HIGHCVSS 7.5EG 7.5
2022-06-01
BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnerable to regular expression denial of service (ReDoS) attacks. By using specific a RegularExpression,…
CVE-2022-26650HIGHCVSS 7.5EG 7.5
2022-05-17
In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious…
CVE-2022-24836HIGHCVSS 7.5EG 7.5
2022-04-11
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised…
CVE-2022-25598HIGHCVSS 7.5EG 7.5
2022-03-30
Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.
CVE-2022-24713HIGHCVSS 7.5EG 7.5
2022-03-08
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (…
CVE-2022-21681HIGHCVSS 7.5EG 7.5
2022-01-14
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted mark…
CVE-2022-21680HIGHCVSS 7.5EG 7.5
2022-01-14
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untr…
CVE-2021-3842HIGHCVSS 7.5EG 7.5
2022-01-04
nltk is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-41817HIGHCVSS 7.5EG 7.5
2022-01-01
Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.
CVE-2021-23490HIGHCVSS 7.5EG 7.5
2021-12-24
The package parse-link-header before 2.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the checkHeader function.
CVE-2021-45470HIGHCVSS 7.5EG 7.5
2021-12-23
lib/DatabaseLayer.py in cve-search before 4.1.0 allows regular expression injection, which can lead to ReDoS (regular expression denial of service) or other impacts.
CVE-2021-43805HIGHCVSS 7.5EG 7.5
2021-12-07
Solidus is a free, open-source ecommerce platform built on Rails. Versions of Solidus prior to 3.1.4, 3.0.4, and 2.11.13 have a denial of service vulnerability that could be exploited during a guest checkout. The regular expression used to…
CVE-2021-3765HIGHCVSS 7.5EG 7.5
2021-11-02
validator.js is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-42836HIGHCVSS 7.5EG 7.5
2021-10-22
GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.
CVE-2021-23446HIGHCVSS 7.5EG 7.5
2021-09-29
The package handsontable before 10.0.0; the package handsontable from 0 and before 10.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) in Handsontable.helper.isNumeric function.
CVE-2021-3828HIGHCVSS 7.5EG 7.5
2021-09-27
nltk is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3822HIGHCVSS 7.5EG 7.5
2021-09-27
jsoneditor is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3820HIGHCVSS 7.5EG 7.5
2021-09-27
inflect is vulnerable to Inefficient Regular Expression Complexity
CVE-2020-23478HIGHCVSS 7.5EG 7.5
2021-09-22
Leo Editor v6.2.1 was discovered to contain a regular expression denial of service (ReDoS) vulnerability in the component plugins/importers/dart.py.

Map vulnerabilities like CWE-1333 to your infrastructure

EchelonGraph correlates every CVE — across CWE-1333 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →