Common Weakness Enumeration
CWE-1333
AllowedInefficient Regular Expression Complexity
Abstraction: Base · Status: Draft
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
731 vulnerabilities reference this CWE, most recent first.
GHSA-MPG4-RC92-VX8V
Vulnerability from github – Published: 2024-07-29 17:46 – Updated: 2024-10-11 14:13
VLAI
Summary
fast-xml-parser vulnerable to ReDOS at currency parsing
Details
Summary
A ReDOS that exists on currency.js was discovered by Gauss Security Labs R&D team.
Details
https://github.com/NaturalIntelligence/fast-xml-parser/blob/v4.4.0/src/v5/valueParsers/currency.js#L10 contains a vulnerable regex
PoC
pass the following string '\t'.repeat(13337) + '.'
Impact
Denial of service during currency parsing in experimental version 5 of fast-xml-parser-library
https://gauss-security.com
Severity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "fast-xml-parser"
},
"ranges": [
{
"events": [
{
"introduced": "4.3.5"
},
{
"fixed": "4.4.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-41818"
],
"database_specific": {
"cwe_ids": [
"CWE-1333",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2024-07-29T17:46:16Z",
"nvd_published_at": "2024-07-29T16:15:05Z",
"severity": "HIGH"
},
"details": "### Summary\nA ReDOS that exists on currency.js was discovered by Gauss Security Labs R\u0026D team.\n\n### Details\nhttps://github.com/NaturalIntelligence/fast-xml-parser/blob/v4.4.0/src/v5/valueParsers/currency.js#L10 contains a vulnerable regex \n\n### PoC\npass the following string \u0027\\t\u0027.repeat(13337) + \u0027.\u0027\n\n### Impact\nDenial of service during currency parsing in experimental version 5 of fast-xml-parser-library\n\nhttps://gauss-security.com",
"id": "GHSA-mpg4-rc92-vx8v",
"modified": "2024-10-11T14:13:07Z",
"published": "2024-07-29T17:46:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-mpg4-rc92-vx8v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41818"
},
{
"type": "WEB",
"url": "https://github.com/NaturalIntelligence/fast-xml-parser/commit/ba5f35e7680468acd7906eaabb2f69e28ed8b2aa"
},
{
"type": "WEB",
"url": "https://github.com/NaturalIntelligence/fast-xml-parser/commit/d0bfe8a3a2813a185f39591bbef222212d856164"
},
{
"type": "PACKAGE",
"url": "https://github.com/NaturalIntelligence/fast-xml-parser"
},
{
"type": "WEB",
"url": "https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/src/v5/valueParsers/currency.js#L10"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "fast-xml-parser vulnerable to ReDOS at currency parsing"
}
GHSA-MR3Q-G2MV-MR4Q
Vulnerability from github – Published: 2025-10-10 20:28 – Updated: 2025-10-13 15:46
VLAI
Summary
Sinatra is vulnerable to ReDoS through ETag header value generation
Details
Summary
There is a denial of service vulnerability in the If-Match and If-None-Match header parsing component of Sinatra, if the etag method is used when constructing the response and you are using Ruby < 3.2.
Details
Carefully crafted input can cause If-Match and If-None-Match header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the ETag header value. Any applications that use the etag method when generating a response are impacted if they are using Ruby below version 3.2.
Resources
- https://github.com/sinatra/sinatra/issues/2120 (report)
- https://github.com/sinatra/sinatra/pull/2121 (fix)
- https://github.com/sinatra/sinatra/pull/1823 (older ReDoS vulnerability)
- https://bugs.ruby-lang.org/issues/19104 (fix in Ruby >= 3.2)
Severity
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "sinatra"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-61921"
],
"database_specific": {
"cwe_ids": [
"CWE-1333",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2025-10-10T20:28:47Z",
"nvd_published_at": "2025-10-10T20:15:38Z",
"severity": "LOW"
},
"details": "### Summary\n\nThere is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response and you are using Ruby \u003c 3.2.\n\n### Details\n\nCarefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted if they are using Ruby below version 3.2.\n\n### Resources\n\n* https://github.com/sinatra/sinatra/issues/2120 (report)\n* https://github.com/sinatra/sinatra/pull/2121 (fix)\n* https://github.com/sinatra/sinatra/pull/1823 (older ReDoS vulnerability)\n* https://bugs.ruby-lang.org/issues/19104 (fix in Ruby \u003e= 3.2)",
"id": "GHSA-mr3q-g2mv-mr4q",
"modified": "2025-10-13T15:46:28Z",
"published": "2025-10-10T20:28:47Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sinatra/sinatra/security/advisories/GHSA-mr3q-g2mv-mr4q"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61921"
},
{
"type": "WEB",
"url": "https://github.com/sinatra/sinatra/issues/2120"
},
{
"type": "WEB",
"url": "https://github.com/sinatra/sinatra/pull/1823"
},
{
"type": "WEB",
"url": "https://github.com/sinatra/sinatra/pull/2121"
},
{
"type": "WEB",
"url": "https://github.com/sinatra/sinatra/commit/3fe8c38dc405586f7ad8f2ac748aa53e9c3615bd"
},
{
"type": "WEB",
"url": "https://github.com/sinatra/sinatra/commit/8ff496bd4877520599e1479d6efead39304edceb"
},
{
"type": "WEB",
"url": "https://bugs.ruby-lang.org/issues/19104"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sinatra/CVE-2025-61921.yml"
},
{
"type": "PACKAGE",
"url": "https://github.com/sinatra/sinatra"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "Sinatra is vulnerable to ReDoS through ETag header value generation"
}
GHSA-MR82-8J83-VXMV
Vulnerability from github – Published: 2024-04-15 03:31 – Updated: 2025-02-13 19:01
VLAI
Summary
Pydantic regular expression denial of service
Details
Regular expression denial of service in Pydantic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service via a crafted email string.
Severity
5.9 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pydantic"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.4.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "pydantic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.10.13"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-3772"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-15T18:11:28Z",
"nvd_published_at": "2024-04-15T03:16:07Z",
"severity": "MODERATE"
},
"details": "Regular expression denial of service in Pydantic \u003c 2.4.0, \u003c 1.10.13 allows remote attackers to cause denial of service via a crafted email string.",
"id": "GHSA-mr82-8j83-vxmv",
"modified": "2025-02-13T19:01:02Z",
"published": "2024-04-15T03:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3772"
},
{
"type": "WEB",
"url": "https://github.com/pydantic/pydantic/pull/7360"
},
{
"type": "WEB",
"url": "https://github.com/pydantic/pydantic/commit/59d8f38fd6220e3917c53785dbc70317d6f8e631"
},
{
"type": "WEB",
"url": "https://github.com/pydantic/pydantic/commit/e4393ae6145c4dadff739990bb0116c6dec3441b"
},
{
"type": "PACKAGE",
"url": "https://github.com/pydantic/pydantic"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6JBZLMSH4GAZOVBMT2JUO2LXHY7M2ALI"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Pydantic regular expression denial of service"
}
GHSA-MVRP-3CVX-C325
Vulnerability from github – Published: 2023-10-04 14:46 – Updated: 2023-10-04 14:46
VLAI
Summary
Zod denial of service vulnerability during email validation
Details
Impact
API servers running express-zod-api having:
- version of
express-zod-apibelow10.0.0-beta1, - and using the following (or similar) validation schema in its implementation:
z.string().email(),
are vulnerable to a DoS attack due to:
- Inefficient Regular Expression Complexity in
zodversions up to3.22.2, - depending on
zod.
Patches
The patched version of zod fixing the vulnerability is 3.22.3.
However, it's highly recommended to upgrade express-zod-api to at least version 10.0.0, which does not depend on zod strictly and directly, but requires its installation as a peer dependency instead, enabling you to install the patched zod version yourself.
Workarounds
When it's not possible to upgrade your dependencies, consider the following replacement in your implementation:
- z.string().email()
+ z.string().regex(
+ /^(?!\.)(?!.*\.\.)([A-Z0-9_+-\.]*)[A-Z0-9_+-]@([A-Z0-9][A-Z0-9\-]*\.)+[A-Z]{2,}$/i
+ )
This regular expression is taken from the suggested patch of zod.
References
- Original issue: https://github.com/colinhacks/zod/issues/2609
- The patch: https://github.com/colinhacks/zod/pull/2824
- Entry in database: https://nvd.nist.gov/vuln/detail/CVE-2023-4316
- Enumeration: https://cwe.mitre.org/data/definitions/1333.html
- Parent advisory: https://github.com/advisories/GHSA-m95q-7qp3-xv42
- Changelog entry for
express-zod-apiversion10.0.0-beta1: https://github.com/RobinTail/express-zod-api/blob/master/CHANGELOG.md#v1000-beta1
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "express-zod-api"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.0.0-beta1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-04T14:46:06Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\n\nAPI servers running `express-zod-api` having:\n\n- version of `express-zod-api` below `10.0.0-beta1`,\n- and using the following (or similar) validation schema in its implementation: `z.string().email()`,\n\nare vulnerable to a DoS attack due to: \n\n- Inefficient Regular Expression Complexity in `zod` versions up to `3.22.2`,\n- depending on `zod`.\n\n### Patches\n\nThe patched version of `zod` fixing the vulnerability is `3.22.3`.\n\nHowever, it\u0027s highly recommended to upgrade `express-zod-api` to at least version `10.0.0`, which does not depend on `zod` strictly and directly, but requires its installation as a peer dependency instead, enabling you to install the patched `zod` version yourself.\n\n### Workarounds\n\nWhen it\u0027s not possible to upgrade your dependencies, consider the following replacement in your implementation:\n\n```diff\n- z.string().email()\n+ z.string().regex(\n+ /^(?!\\.)(?!.*\\.\\.)([A-Z0-9_+-\\.]*)[A-Z0-9_+-]@([A-Z0-9][A-Z0-9\\-]*\\.)+[A-Z]{2,}$/i\n+ )\n```\n\nThis regular expression is taken from the suggested patch of `zod`.\n\n### References\n\n- Original issue: https://github.com/colinhacks/zod/issues/2609\n- The patch: https://github.com/colinhacks/zod/pull/2824\n- Entry in database: https://nvd.nist.gov/vuln/detail/CVE-2023-4316\n- Enumeration: https://cwe.mitre.org/data/definitions/1333.html\n- Parent advisory: https://github.com/advisories/GHSA-m95q-7qp3-xv42\n- Changelog entry for `express-zod-api` version `10.0.0-beta1`: https://github.com/RobinTail/express-zod-api/blob/master/CHANGELOG.md#v1000-beta1",
"id": "GHSA-mvrp-3cvx-c325",
"modified": "2023-10-04T14:46:06Z",
"published": "2023-10-04T14:46:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/RobinTail/express-zod-api/security/advisories/GHSA-mvrp-3cvx-c325"
},
{
"type": "WEB",
"url": "https://github.com/colinhacks/zod/issues/2609"
},
{
"type": "WEB",
"url": "https://github.com/colinhacks/zod/pull/2824"
},
{
"type": "PACKAGE",
"url": "https://github.com/RobinTail/express-zod-api"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-m95q-7qp3-xv42"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Zod denial of service vulnerability during email validation"
}
GHSA-MX3P-FHPW-X6RV
Vulnerability from github – Published: 2024-04-19 18:31 – Updated: 2025-11-04 19:45
VLAI
Summary
TCPDF vulnerable to Regular Expression Denial of Service
Details
TCPDF version <= 6.7.4 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.7.4"
},
"package": {
"ecosystem": "Packagist",
"name": "tecnickcom/tcpdf"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.7.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-22640"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-19T19:49:13Z",
"nvd_published_at": "2024-04-19T16:15:09Z",
"severity": "MODERATE"
},
"details": "TCPDF version \u003c= 6.7.4 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.",
"id": "GHSA-mx3p-fhpw-x6rv",
"modified": "2025-11-04T19:45:34Z",
"published": "2024-04-19T18:31:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22640"
},
{
"type": "WEB",
"url": "https://github.com/tecnickcom/TCPDF/commit/05f3a28f4a7905019469e040cf77e53d6aa7f679"
},
{
"type": "PACKAGE",
"url": "https://github.com/tecnickcom/TCPDF"
},
{
"type": "WEB",
"url": "https://github.com/zunak/CVE-2024-22640"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/06/msg00004.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LIB3R2WB7XPW2I4PGVMZ3VLFLRHOK4RB"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LIB3R2WB7XPW2I4PGVMZ3VLFLRHOK4RB"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "TCPDF vulnerable to Regular Expression Denial of Service"
}
GHSA-MX3X-GHQM-R43H
Vulnerability from github – Published: 2021-10-12 16:27 – Updated: 2021-10-08 22:13
VLAI
Summary
Prototype pollution vulnerability in 'predefine'
Details
Prototype pollution vulnerability in 'predefine' versions 0.0.0 through 0.1.2 allows an attacker to cause a denial of service and may lead to remote code execution.
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "predefine"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-28280"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2021-10-08T22:13:34Z",
"nvd_published_at": "2020-12-29T18:15:00Z",
"severity": "CRITICAL"
},
"details": "Prototype pollution vulnerability in \u0027predefine\u0027 versions 0.0.0 through 0.1.2 allows an attacker to cause a denial of service and may lead to remote code execution.",
"id": "GHSA-mx3x-ghqm-r43h",
"modified": "2021-10-08T22:13:34Z",
"published": "2021-10-12T16:27:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28280"
},
{
"type": "WEB",
"url": "https://github.com/bigpipe/predefine/commit/1a86a013c0b37c9d6ca078ba34017052af38b7fc"
},
{
"type": "PACKAGE",
"url": "https://github.com/bigpipe/predefine"
},
{
"type": "WEB",
"url": "https://github.com/bigpipe/predefine/blob/238137e3d1b8288ff5d7529c3cbcdd371888c26b/index.js#L284"
},
{
"type": "WEB",
"url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28280"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype pollution vulnerability in \u0027predefine\u0027"
}
GHSA-P27H-4CPF-FW48
Vulnerability from github – Published: 2022-12-27 09:30 – Updated: 2023-01-10 21:42
VLAI
Summary
email-existence Inefficient Regular Expression Complexity vulnerability
Details
A vulnerability was found in email-existence. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The name of the patch is 0029ba71b6ad0d8ec0baa2ecc6256d038bdd9b56. It is recommended to apply a patch to fix this issue. VDB-216854 is the identifier assigned to this vulnerability.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "email-existence"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.1.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-25049"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-30T17:40:18Z",
"nvd_published_at": "2022-12-27T09:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability was found in email-existence. It has been rated as problematic. Affected by this issue is some unknown functionality of the file `index.js`. The manipulation leads to inefficient regular expression complexity. The name of the patch is 0029ba71b6ad0d8ec0baa2ecc6256d038bdd9b56. It is recommended to apply a patch to fix this issue. VDB-216854 is the identifier assigned to this vulnerability.",
"id": "GHSA-p27h-4cpf-fw48",
"modified": "2023-01-10T21:42:08Z",
"published": "2022-12-27T09:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25049"
},
{
"type": "WEB",
"url": "https://github.com/nmanousos/email-existence/pull/37"
},
{
"type": "WEB",
"url": "https://github.com/nmanousos/email-existence/commit/0029ba71b6ad0d8ec0baa2ecc6256d038bdd9b56"
},
{
"type": "PACKAGE",
"url": "https://github.com/nmanousos/email-existence"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.216854"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.216854"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "email-existence Inefficient Regular Expression Complexity vulnerability"
}
GHSA-P28H-CC7Q-C4FG
Vulnerability from github – Published: 2022-10-01 00:00 – Updated: 2025-05-20 21:02
VLAI
Summary
css-what vulnerable to ReDoS due to use of insecure regular expression
Details
The package css-what before 2.1.3 is vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "css-what"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-21222"
],
"database_specific": {
"cwe_ids": [
"CWE-1333",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2022-10-04T21:11:32Z",
"nvd_published_at": "2022-09-30T05:15:00Z",
"severity": "HIGH"
},
"details": "The package css-what before 2.1.3 is vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of insecure regular expression in the `re_attr` variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.",
"id": "GHSA-p28h-cc7q-c4fg",
"modified": "2025-05-20T21:02:33Z",
"published": "2022-10-01T00:00:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21222"
},
{
"type": "WEB",
"url": "https://github.com/fb55/css-what/commit/dc510929790da6617e7aa93a616498b22f6a6b72"
},
{
"type": "PACKAGE",
"url": "https://github.com/fb55/css-what"
},
{
"type": "WEB",
"url": "https://github.com/fb55/css-what/blob/a38effd5a8f5506d75c7f8f13cbd8c76248a3860/index.js#23L12"
},
{
"type": "WEB",
"url": "https://github.com/fb55/css-what/blob/a38effd5a8f5506d75c7f8f13cbd8c76248a3860/index.js%23L12"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00001.html"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-CSSWHAT-3035488"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "css-what vulnerable to ReDoS due to use of insecure regular expression"
}
GHSA-P2M9-WCP5-6QW3
Vulnerability from github – Published: 2026-03-12 18:32 – Updated: 2026-03-12 18:32
VLAI
Summary
multipart vulnerable to ReDoS in `parse_options_header()`
Details
Summary
The parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential backtracking (ReDoS) when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for denial of service (DoS) attacks against web applications using this library to parse request headers or multipart/form-data streams.
Impact
Any WSGI or ASGI application using multipart.parse_form_data() directly or indirectly (e.g. while parsing multipart/form-data streams) is vulnerable. The slow-down is significant enough to block request handling threads for multiple seconds per request.
Affected versions
All versions up to and including 1.3.0 are affected. The issue is fixed in 1.2.2, 1.3.1 and 1.4.0-dev.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "multipart"
},
"ranges": [
{
"events": [
{
"introduced": "1.3.0"
},
{
"fixed": "1.3.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "multipart"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-28356"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-12T18:32:18Z",
"nvd_published_at": "2026-03-12T17:16:50Z",
"severity": "HIGH"
},
"details": "## Summary\n\nThe `parse_options_header()` function in `multipart.py` uses a regular expression with an *ambiguous alternation*, which can cause *exponential backtracking (ReDoS)* when parsing maliciously crafted HTTP or multipart segment headers. This can be abused for **denial of service (DoS)** attacks against web applications using this library to parse request headers or `multipart/form-data` streams.\n\n## Impact\n\nAny WSGI or ASGI application using `multipart.parse_form_data()` directly or indirectly (e.g. while parsing `multipart/form-data` streams) is vulnerable. The slow-down is significant enough to block request handling threads for multiple seconds per request.\n\n## Affected versions\n\nAll versions up to and including `1.3.0` are affected. The issue is fixed in `1.2.2`, `1.3.1` and `1.4.0-dev`.",
"id": "GHSA-p2m9-wcp5-6qw3",
"modified": "2026-03-12T18:32:18Z",
"published": "2026-03-12T18:32:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/defnull/multipart/security/advisories/GHSA-p2m9-wcp5-6qw3"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28356"
},
{
"type": "PACKAGE",
"url": "https://github.com/defnull/multipart"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "multipart vulnerable to ReDoS in `parse_options_header()`"
}
GHSA-P4PJ-MG4R-X6V4
Vulnerability from github – Published: 2021-02-02 15:46 – Updated: 2024-02-08 22:17
VLAI
Summary
Denial of Service in uap-core
Details
Impact
Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.
Patches
Please update uap-core to >= v0.11.0
Downstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "uap-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.11.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-21317"
],
"database_specific": {
"cwe_ids": [
"CWE-1333",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2021-02-01T16:57:05Z",
"nvd_published_at": "2021-02-16T18:15:00Z",
"severity": "HIGH"
},
"details": "## Impact\n\nSome regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.\n\n## Patches\n\nPlease update uap-core to \u003e= v0.11.0\n\nDownstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes.",
"id": "GHSA-p4pj-mg4r-x6v4",
"modified": "2024-02-08T22:17:20Z",
"published": "2021-02-02T15:46:38Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ua-parser/uap-core/security/advisories/GHSA-p4pj-mg4r-x6v4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21317"
},
{
"type": "WEB",
"url": "https://github.com/ua-parser/uap-core/commit/dc9925d458214cfe87b93e35346980612f6ae96c"
},
{
"type": "PACKAGE",
"url": "https://github.com/ua-parser/uap-core"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/uap-core"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Denial of Service in uap-core"
}
Mitigation
Architecture and Design
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
Mitigation
System Configuration
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Mitigation
Implementation
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
Mitigation
Implementation
Limit the length of the input that the regular expression will process.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.