Common Weakness Enumeration
CWE-1333
AllowedInefficient Regular Expression Complexity
Abstraction: Base · Status: Draft
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
809 vulnerabilities reference this CWE, most recent first.
GHSA-VM8Q-M57G-PFF3
Vulnerability from github – Published: 2024-03-15 21:30 – Updated: 2025-11-04 21:31
VLAI
Summary
Regular expression denial-of-service in Django
Details
In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.
Severity
5.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "3.2"
},
{
"fixed": "3.2.25"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "4.2"
},
{
"fixed": "4.2.11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "5.0"
},
{
"fixed": "5.0.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-27351"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2024-03-18T20:36:41Z",
"nvd_published_at": "2024-03-15T20:15:09Z",
"severity": "MODERATE"
},
"details": "In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_html template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232 and CVE-2023-43665.",
"id": "GHSA-vm8q-m57g-pff3",
"modified": "2025-11-04T21:31:20Z",
"published": "2024-03-15T21:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27351"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/3394fc6132436eca89e997083bae9985fb7e761e"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/3c9a2771cc80821e041b16eb36c1c37af5349d4a"
},
{
"type": "WEB",
"url": "https://docs.djangoproject.com/en/5.0/releases/security"
},
{
"type": "PACKAGE",
"url": "https://github.com/django/django"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-47.yaml"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#%21forum/django-announce"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2JIRXEDP4ZET5KFMAPPYSK663Q52NEX"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SN2PLJGYSAAG5KUVIUFJYKD3BLQ4OSN6"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2JIRXEDP4ZET5KFMAPPYSK663Q52NEX"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SN2PLJGYSAAG5KUVIUFJYKD3BLQ4OSN6"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQJOMNRMVPCN5WMIZ7YSX5LQ7IR2NY4D"
},
{
"type": "WEB",
"url": "https://www.djangoproject.com/weblog/2024/mar/04/security-releases"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/03/04/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Regular expression denial-of-service in Django"
}
GHSA-VP3X-9QPG-Q385
Vulnerability from github – Published: 2025-01-04 15:30 – Updated: 2025-01-04 15:30
VLAI
Details
IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to cause a denial of service using a complex regular expression.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-41766"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-04T15:15:06Z",
"severity": "HIGH"
},
"details": "IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to cause a denial of service using a complex regular expression.",
"id": "GHSA-vp3x-9qpg-q385",
"modified": "2025-01-04T15:30:45Z",
"published": "2025-01-04T15:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41766"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7180203"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VP56-6G26-6827
Vulnerability from github – Published: 2022-08-02 00:00 – Updated: 2022-08-04 17:37
VLAI
Summary
node-fetch Inefficient Regular Expression Complexity
Details
node-fetch is a light-weight module that brings window.fetch to node.js.
Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the isOriginPotentiallyTrustworthy() function in referrer.js, when processing a URL string with alternating letters and periods, such as 'http://' + 'a.a.'.repeat(i) + 'a'.
Severity
5.9 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "node-fetch"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-2596"
],
"database_specific": {
"cwe_ids": [
"CWE-1333",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2022-08-04T17:37:24Z",
"nvd_published_at": "2022-08-01T15:15:00Z",
"severity": "MODERATE"
},
"details": "[node-fetch](https://www.npmjs.com/package/node-fetch) is a light-weight module that brings window.fetch to node.js.\n\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the `isOriginPotentiallyTrustworthy()` function in `referrer.js`, when processing a URL string with alternating letters and periods, such as `\u0027http://\u0027 + \u0027a.a.\u0027.repeat(i) + \u0027a\u0027`.",
"id": "GHSA-vp56-6g26-6827",
"modified": "2022-08-04T17:37:24Z",
"published": "2022-08-02T00:00:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2596"
},
{
"type": "WEB",
"url": "https://github.com/node-fetch/node-fetch/pull/1611"
},
{
"type": "WEB",
"url": "https://github.com/node-fetch/node-fetch/commit/28802387292baee467e042e168d92597b5bbbe3d"
},
{
"type": "PACKAGE",
"url": "https://github.com/node-fetch/node-fetch"
},
{
"type": "WEB",
"url": "https://github.com/node-fetch/node-fetch/releases/tag/v3.2.10"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/a7e6a136-0a4b-46c4-ad20-802f1dd60bf7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "node-fetch Inefficient Regular Expression Complexity "
}
GHSA-VQC4-V8HC-H2JG
Vulnerability from github – Published: 2022-08-31 22:23 – Updated: 2022-09-08 14:11
VLAI
Summary
Polynomial regular expression used on uncontrolled data in nitrado.js
Details
Impact
Possible ReDoS with lib input of {{ and with many repetitions of {{|
Patches
Patched in all versions above 0.2.5
Workarounds
No known work arounds.
References
- OWASP: Regular expression Denial of Service - ReDoS
- Wikipedia: ReDoS.
- Wikipedia: Time complexity.
- James Kirrage, Asiri Rathnayake, Hayo Thielecke: Static Analysis for Regular Expression Denial-of-Service Attack.
- Common Weakness Enumeration: CWE-1333.
- Common Weakness Enumeration: CWE-400.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "nitrado.js"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-36034"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2022-08-31T22:23:39Z",
"nvd_published_at": "2022-08-29T17:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\nPossible ReDoS with lib input of `{{` and with many repetitions of `{{|`\n\n### Patches\nPatched in all versions above `0.2.5`\n\n### Workarounds\nNo known work arounds.\n\n### References\n- OWASP: [Regular expression Denial of Service - ReDoS](https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS)\n- Wikipedia: [ReDoS](https://en.wikipedia.org/wiki/ReDoS).\n- Wikipedia: [Time complexity](https://en.wikipedia.org/wiki/Time_complexity).\n- James Kirrage, Asiri Rathnayake, Hayo Thielecke: [Static Analysis for Regular Expression Denial-of-Service Attack](http://www.cs.bham.ac.uk/~hxt/research/reg-exp-sec.pdf).\n- Common Weakness Enumeration: [CWE-1333](https://cwe.mitre.org/data/definitions/1333.html).\n- Common Weakness Enumeration: [CWE-400](https://cwe.mitre.org/data/definitions/400.html).\n\n\n",
"id": "GHSA-vqc4-v8hc-h2jg",
"modified": "2022-09-08T14:11:35Z",
"published": "2022-08-31T22:23:39Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cainthebest/nitrado.js/security/advisories/GHSA-vqc4-v8hc-h2jg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36034"
},
{
"type": "PACKAGE",
"url": "https://github.com/cainthebest/nitrado.js"
},
{
"type": "WEB",
"url": "https://github.com/cainthebest/nitrado.js/blob/v0.2.5/CHANGELOG.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Polynomial regular expression used on uncontrolled data in nitrado.js"
}
GHSA-VQHP-CXGC-6WMM
Vulnerability from github – Published: 2020-03-30 19:45 – Updated: 2025-03-20 18:49
VLAI
Summary
regular expression denial-of-service (ReDoS) in Bleach
Details
Impact
bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS).
Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
Patches
3.1.4
Workarounds
-
do not whitelist the style attribute in
bleach.cleancalls -
limit input string length
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1623633
- https://www.regular-expressions.info/redos.html
- https://blog.r2c.dev/posts/finding-python-redos-bugs-at-scale-using-dlint-and-r2c/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6817
Credits
- Reported by schwag09 of r2c
For more information
If you have any questions or comments about this advisory:
- Open an issue at https://github.com/mozilla/bleach/issues
- Email us at security@mozilla.org
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "bleach"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-6817"
],
"database_specific": {
"cwe_ids": [
"CWE-1333",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2020-03-27T19:58:38Z",
"nvd_published_at": "2023-02-16T22:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\n\n`bleach.clean` behavior parsing style attributes could result in a regular expression denial of service (ReDoS).\n\nCalls to ``bleach.clean`` with an allowed tag with an allowed ``style`` attribute are vulnerable to ReDoS. For example, ``bleach.clean(..., attributes={\u0027a\u0027: [\u0027style\u0027]})``.\n\n### Patches\n\n3.1.4\n\n### Workarounds\n\n* do not whitelist the style attribute in `bleach.clean` calls\n\n* limit input string length\n\n### References\n\n* https://bugzilla.mozilla.org/show_bug.cgi?id=1623633\n* https://www.regular-expressions.info/redos.html\n* https://blog.r2c.dev/posts/finding-python-redos-bugs-at-scale-using-dlint-and-r2c/\n* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6817\n\n### Credits\n\n* Reported by schwag09 of r2c\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Open an issue at https://github.com/mozilla/bleach/issues\n* Email us at security@mozilla.org",
"id": "GHSA-vqhp-cxgc-6wmm",
"modified": "2025-03-20T18:49:18Z",
"published": "2020-03-30T19:45:56Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mozilla/bleach/security/advisories/GHSA-vqhp-cxgc-6wmm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6817"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1623633"
},
{
"type": "PACKAGE",
"url": "https://github.com/mozilla/bleach"
},
{
"type": "WEB",
"url": "https://github.com/mozilla/bleach/releases/tag/v3.1.4"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/bleach/PYSEC-2020-340.yaml"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PYTHON-BLEACH-561754"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "regular expression denial-of-service (ReDoS) in Bleach"
}
GHSA-VQPR-J7V3-HQW9
Vulnerability from github – Published: 2025-11-26 19:33 – Updated: 2025-11-26 19:33
VLAI
Summary
Valibot has a ReDoS vulnerability in `EMOJI_REGEX`
Details
Summary
The EMOJI_REGEX used in the emoji action is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. A short, maliciously crafted string (e.g., <100 characters) can cause the regex engine to consume excessive CPU time (minutes), leading to a Denial of Service (DoS) for the application.
Details
The ReDoS vulnerability stems from "catastrophic backtracking" in the EMOJI_REGEX. This is caused by ambiguity in the regex pattern due to overlapping character classes.
Specifically, the class \p{Emoji_Presentation} overlaps with more specific classes used in the same alternation, such as [\u{1F1E6}-\u{1F1FF}] (regional indicator symbols used for flags) and \p{Emoji_Modifier_Base}.
When the regex engine attempts to match a string that almost matches but ultimately fails (like the one in the PoC), this ambiguity forces it to explore an exponential number of possible paths. The matching time increases exponentially with the length of the crafted input, rather than linearly.
PoC
The following code demonstrates the vulnerability.
import * as v from 'valibot';
const schema = v.object({
x: v.pipe(v.string(), v.emoji()),
});
const attackString = '\u{1F1E6}'.repeat(49) + '0';
console.log(`Input length: ${attackString.length}`);
console.log('Starting parse... (This will take a long time)');
// On my machine, a length of 99 takes approximately 2 minutes.
console.time();
try {
v.parse(schema, {x: attackString });
} catch (e) {}
console.timeEnd();
Impact
Any project using Valibot's emoji validation on user-controllable input is vulnerable to a Denial of Service attack.
An attacker can block server resources (e.g., a web server's event loop) by submitting a short string to any endpoint that uses this validation. This is particularly dangerous because the attack string is short enough to bypass typical input length restrictions (e.g., maxLength(100)).
Recommended Fix
The root cause is the overlapping character classes. This can be resolved by making the alternatives mutually exclusive, typically by using negative lookaheads ((?!...)) to subtract the specific classes from the more general one.
The following modified EMOJI_REGEX applies this principle:
export const EMOJI_REGEX: RegExp =
// eslint-disable-next-line redos-detector/no-unsafe-regex, regexp/no-dupe-disjunctions -- false positives
/^(?:[\u{1F1E6}-\u{1F1FF}]{2}|\u{1F3F4}[\u{E0061}-\u{E007A}]{2}[\u{E0030}-\u{E0039}\u{E0061}-\u{E007A}]{1,3}\u{E007F}|(?:\p{Emoji}\uFE0F\u20E3?|\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|(?![\p{Emoji_Modifier_Base}\u{1F1E6}-\u{1F1FF}])\p{Emoji_Presentation})(?:\u200D(?:\p{Emoji}\uFE0F\u20E3?|\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|(?![\p{Emoji_Modifier_Base}\u{1F1E6}-\u{1F1FF}])\p{Emoji_Presentation}))*)+$/u;
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "valibot"
},
"ranges": [
{
"events": [
{
"introduced": "0.31.0"
},
{
"fixed": "1.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-66020"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-26T19:33:34Z",
"nvd_published_at": "2025-11-26T02:15:49Z",
"severity": "HIGH"
},
"details": "### Summary\n\nThe `EMOJI_REGEX` used in the `emoji` action is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. A short, maliciously crafted string (e.g., \u003c100 characters) can cause the regex engine to consume excessive CPU time (minutes), leading to a Denial of Service (DoS) for the application.\n\n### Details\n\nThe ReDoS vulnerability stems from \"catastrophic backtracking\" in the `EMOJI_REGEX`. This is caused by ambiguity in the regex pattern due to overlapping character classes.\n\nSpecifically, the class `\\p{Emoji_Presentation}` overlaps with more specific classes used in the same alternation, such as `[\\u{1F1E6}-\\u{1F1FF}]` (regional indicator symbols used for flags) and `\\p{Emoji_Modifier_Base}`.\n\nWhen the regex engine attempts to match a string that almost matches but ultimately fails (like the one in the PoC), this ambiguity forces it to explore an exponential number of possible paths. The matching time increases exponentially with the length of the crafted input, rather than linearly.\n\n### PoC\n\nThe following code demonstrates the vulnerability.\n\n```javascript\nimport * as v from \u0027valibot\u0027;\n\nconst schema = v.object({\n x: v.pipe(v.string(), v.emoji()),\n});\n\nconst attackString = \u0027\\u{1F1E6}\u0027.repeat(49) + \u00270\u0027;\n\nconsole.log(`Input length: ${attackString.length}`);\nconsole.log(\u0027Starting parse... (This will take a long time)\u0027);\n\n// On my machine, a length of 99 takes approximately 2 minutes.\nconsole.time();\ntry {\n v.parse(schema, {x: attackString });\n} catch (e) {}\nconsole.timeEnd();\n```\n\n### Impact\n\nAny project using Valibot\u0027s `emoji` validation on user-controllable input is vulnerable to a Denial of Service attack.\n\nAn attacker can block server resources (e.g., a web server\u0027s event loop) by submitting a short string to any endpoint that uses this validation. This is particularly dangerous because the attack string is short enough to bypass typical input length restrictions (e.g., maxLength(100)).\n\n### Recommended Fix\n\nThe root cause is the overlapping character classes. This can be resolved by making the alternatives mutually exclusive, typically by using negative lookaheads (`(?!...)`) to subtract the specific classes from the more general one.\n\nThe following modified `EMOJI_REGEX` applies this principle:\n\n```javascript\nexport const EMOJI_REGEX: RegExp =\n // eslint-disable-next-line redos-detector/no-unsafe-regex, regexp/no-dupe-disjunctions -- false positives\n /^(?:[\\u{1F1E6}-\\u{1F1FF}]{2}|\\u{1F3F4}[\\u{E0061}-\\u{E007A}]{2}[\\u{E0030}-\\u{E0039}\\u{E0061}-\\u{E007A}]{1,3}\\u{E007F}|(?:\\p{Emoji}\\uFE0F\\u20E3?|\\p{Emoji_Modifier_Base}\\p{Emoji_Modifier}?|(?![\\p{Emoji_Modifier_Base}\\u{1F1E6}-\\u{1F1FF}])\\p{Emoji_Presentation})(?:\\u200D(?:\\p{Emoji}\\uFE0F\\u20E3?|\\p{Emoji_Modifier_Base}\\p{Emoji_Modifier}?|(?![\\p{Emoji_Modifier_Base}\\u{1F1E6}-\\u{1F1FF}])\\p{Emoji_Presentation}))*)+$/u;\n```",
"id": "GHSA-vqpr-j7v3-hqw9",
"modified": "2025-11-26T19:33:34Z",
"published": "2025-11-26T19:33:34Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/open-circle/valibot/security/advisories/GHSA-vqpr-j7v3-hqw9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66020"
},
{
"type": "WEB",
"url": "https://github.com/open-circle/valibot/commit/cfb799db301a953a0950d5c05a34a3ab121262dc"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-circle/valibot"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Valibot has a ReDoS vulnerability in `EMOJI_REGEX`"
}
GHSA-VVF2-PPJ9-PP49
Vulnerability from github – Published: 2021-09-20 20:42 – Updated: 2022-05-04 03:24
VLAI
Summary
Inefficient Regular Expression Complexity in vuelidate
Details
vuelidate is a simple, lightweight model-based validation for Vue.js 2.x & 3.0. A ReDoS (regular expression denial of service) flaw was found in the @vuelidate/validators package. An attacker that is able to provide crafted input to the url(input) function may cause an application to consume an excessive amount of CPU.
Severity
7.5 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.0.0-alpha.21"
},
"package": {
"ecosystem": "npm",
"name": "@vuelidate/validators"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.0-alpha.22"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-3794"
],
"database_specific": {
"cwe_ids": [
"CWE-1333",
"CWE-400",
"CWE-697"
],
"github_reviewed": true,
"github_reviewed_at": "2021-09-16T17:15:49Z",
"nvd_published_at": "2021-09-15T13:15:00Z",
"severity": "HIGH"
},
"details": "vuelidate is a simple, lightweight model-based validation for Vue.js 2.x \u0026 3.0. A ReDoS (regular expression denial of service) flaw was found in the `@vuelidate/validators` package. An attacker that is able to provide crafted input to the url(input) function may cause an application to consume an excessive amount of CPU.",
"id": "GHSA-vvf2-ppj9-pp49",
"modified": "2022-05-04T03:24:54Z",
"published": "2021-09-20T20:42:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3794"
},
{
"type": "WEB",
"url": "https://github.com/vuelidate/vuelidate/commit/1f0ca31c30e5032f00dbd14c4791b5ee7928f71d"
},
{
"type": "PACKAGE",
"url": "https://github.com/vuelidate/vuelidate"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/d8201b98-fb91-4c12-a6f7-181b4a20d9b7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Inefficient Regular Expression Complexity in vuelidate"
}
GHSA-W3V8-GMH9-3WV7
Vulnerability from github – Published: 2026-09-08 20:28 – Updated: 2026-09-08 20:28
VLAI
Summary
NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions
Details
Summary
The NLTK tgrep module accepts user-supplied regular expressions and passes them to the Python re engine without a timeout or validation, enabling catastrophic backtracking (ReDoS). Applications that expose the tgrep API to external input are vulnerable to a single-request denial of service that blocks the Python process indefinitely.
Affected Code
nltk/tgrep.py — _tgrep_node_action() (around line 320)
When a tgrep pattern contains a /regex/ node, _tgrep_node_action compiles the embedded regex literal directly with no validation:
def _tgrep_node_action(_s, _l, tokens):
...
elif tokens[0].startswith("/"):
assert tokens[0].endswith("/")
node_lit = tokens[0][1:-1]
return (
lambda r: lambda n, m=None, l=None: r.search(
_tgrep_node_literal_value(n)
)
)(re.compile(node_lit)) # User regex compiled and executed with no timeout
The compiled regex is applied against every matching tree node label via r.search(...). A caller reaching this path via tgrep_positions() or tgrep_compile() controls node_lit entirely.
Proof of Concept
import nltk
from nltk.tgrep import tgrep_positions
# Root node label is 25 'a' characters.
# tgrep /regex/ branch calls re.compile("((a+)+)b").search("aaa...a")
# No 'b' is present — exponential backtracking occurs.
tree = nltk.Tree.fromstring("(" + "a" * 25 + " (NP (DT the)))")
tgrep_positions(r"/((a+)+)b/", [tree]) # Never returns
Working Poc
The following script uses increasing values of n (the number of repeated as in the tree root label) to measure the execution time of tgrep_positions with the catastrophic regex /((a+)+)b/. On standard CPython with NLTK 3.10.2, the runtime grows exponentially, confirming the ReDoS vulnerability. For n ≥ 35, the function will hang indefinitely.
import nltk
from nltk.tgrep import tgrep_positions
import time
def test_n(n):
tree = nltk.Tree.fromstring("(" + "a" * n + " (NP (DT the)))")
pattern = r"/((a+)+)b/"
start = time.perf_counter()
list(tgrep_positions(pattern, [tree]))
return time.perf_counter() - start
if __name__ == "__main__":
# Adjust the range if needed – these values complete quickly
n_values = [18, 20, 22, 24, 26, 28]
print(f"Testing n = {n_values}\n")
times = []
for n in n_values:
t = test_n(n)
times.append((n, t))
print(f"n={n:2d} done", flush=True)
print("\n--- Increase factors (per step in n) ---")
factors = []
for i in range(1, len(times)):
prev_n, prev_t = times[i-1]
curr_n, curr_t = times[i]
factor = curr_t / prev_t
factors.append((curr_n, factor))
print(f"n={curr_n:2d} : factor = {factor:.2f}x (vs n={prev_n})")
avg = sum(f for _, f in factors) / len(factors)
print(f"\nAverage factor: {avg:.2f}x")
print("\n✅ Confirmed: exponential growth (catastrophic backtracking).")
print(" Larger n (≥ 35) will hang indefinitely.")
When run, the output shows a clear exponential increase (factor > 3.0 per +2 in n), proving the vulnerability.
Impact
In environments like web APIs (Flask, FastAPI), Jupyter notebooks, or multi-tenant pipelines, an unauthenticated attacker can cause indefinite CPU saturation with a single crafted request, denying service to all other users of the process.
Remediation
This issue remains unfixed in versions <= 3.10.2. Maintainers are currently collaborating on a patch to wrap the regex execution in a timeout-guarded mechanism.
Credit
Tool: Kira by Offgrid Security
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.10.2"
},
"package": {
"ecosystem": "PyPI",
"name": "nltk"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.10.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-80206"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-08T20:28:28Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nThe NLTK `tgrep` module accepts user-supplied regular expressions and passes them to the Python `re` engine without a timeout or validation, enabling catastrophic backtracking (ReDoS). Applications that expose the `tgrep` API to external input are vulnerable to a single-request denial of service that blocks the Python process indefinitely.\n\n### Affected Code\n`nltk/tgrep.py` \u2014 `_tgrep_node_action()` (around line 320)\n\nWhen a tgrep pattern contains a `/regex/` node, `_tgrep_node_action` compiles the embedded regex literal directly with no validation:\n\n```python\ndef _tgrep_node_action(_s, _l, tokens):\n ...\n elif tokens[0].startswith(\"/\"):\n assert tokens[0].endswith(\"/\")\n node_lit = tokens[0][1:-1]\n return (\n lambda r: lambda n, m=None, l=None: r.search(\n _tgrep_node_literal_value(n)\n )\n )(re.compile(node_lit)) # User regex compiled and executed with no timeout\n```\nThe compiled regex is applied against every matching tree node label via `r.search(...)`. A caller reaching this path via `tgrep_positions()` or `tgrep_compile()` controls `node_lit` entirely.\n\n### Proof of Concept\n```python\nimport nltk\nfrom nltk.tgrep import tgrep_positions\n\n# Root node label is 25 \u0027a\u0027 characters.\n# tgrep /regex/ branch calls re.compile(\"((a+)+)b\").search(\"aaa...a\")\n# No \u0027b\u0027 is present \u2014 exponential backtracking occurs.\ntree = nltk.Tree.fromstring(\"(\" + \"a\" * 25 + \" (NP (DT the)))\")\ntgrep_positions(r\"/((a+)+)b/\", [tree]) # Never returns\n```\n\n### Working Poc\n\nThe following script uses increasing values of n (the number of repeated as in the tree root label) to measure the execution time of tgrep_positions with the catastrophic regex /((a+)+)b/. On standard CPython with NLTK 3.10.2, the runtime grows exponentially, confirming the ReDoS vulnerability. For n \u2265 35, the function will hang indefinitely.\n\n```python\nimport nltk\nfrom nltk.tgrep import tgrep_positions\nimport time\n\ndef test_n(n):\n tree = nltk.Tree.fromstring(\"(\" + \"a\" * n + \" (NP (DT the)))\")\n pattern = r\"/((a+)+)b/\"\n start = time.perf_counter()\n list(tgrep_positions(pattern, [tree]))\n return time.perf_counter() - start\n\nif __name__ == \"__main__\":\n # Adjust the range if needed \u2013 these values complete quickly\n n_values = [18, 20, 22, 24, 26, 28]\n print(f\"Testing n = {n_values}\\n\")\n\n times = []\n for n in n_values:\n t = test_n(n)\n times.append((n, t))\n print(f\"n={n:2d} done\", flush=True)\n\n print(\"\\n--- Increase factors (per step in n) ---\")\n factors = []\n for i in range(1, len(times)):\n prev_n, prev_t = times[i-1]\n curr_n, curr_t = times[i]\n factor = curr_t / prev_t\n factors.append((curr_n, factor))\n print(f\"n={curr_n:2d} : factor = {factor:.2f}x (vs n={prev_n})\")\n\n avg = sum(f for _, f in factors) / len(factors)\n print(f\"\\nAverage factor: {avg:.2f}x\")\n print(\"\\n\u2705 Confirmed: exponential growth (catastrophic backtracking).\")\n print(\" Larger n (\u2265 35) will hang indefinitely.\")\n```\n\nWhen run, the output shows a clear exponential increase (factor \u003e 3.0 per +2 in n), proving the vulnerability.\n\n\n### Impact\nIn environments like web APIs (Flask, FastAPI), Jupyter notebooks, or multi-tenant pipelines, an unauthenticated attacker can cause indefinite CPU saturation with a single crafted request, denying service to all other users of the process.\n\n### Remediation\nThis issue remains unfixed in versions `\u003c= 3.10.2`. Maintainers are currently collaborating on a patch to wrap the regex execution in a timeout-guarded mechanism.\n\n### Credit\nTool: Kira by [Offgrid Security](https://www.offgridsec.com)",
"id": "GHSA-w3v8-gmh9-3wv7",
"modified": "2026-09-08T20:28:28Z",
"published": "2026-09-08T20:28:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nltk/nltk/security/advisories/GHSA-w3v8-gmh9-3wv7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80206"
},
{
"type": "WEB",
"url": "https://github.com/nltk/nltk/commit/0072ea2fb8be22e038a36e887b7061bb6b9339d9"
},
{
"type": "PACKAGE",
"url": "https://github.com/nltk/nltk"
},
{
"type": "WEB",
"url": "https://github.com/nltk/nltk/releases/tag/v3.10.3"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3751.yaml"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/nltk-3.10.2-regular-expression-denial-of-service-via-tgrep"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions"
}
GHSA-W455-MFQ9-HF74
Vulnerability from github – Published: 2024-10-26 21:30 – Updated: 2024-11-13 23:24
VLAI
Summary
insane vulnerable to Regular Expression Denial of Service
Details
insane is a whitelist-oriented HTML sanitizer. Versions 2.6.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.
Severity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "insane"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.6.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-26303"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2024-10-28T14:40:03Z",
"nvd_published_at": "2024-10-26T21:15:13Z",
"severity": "MODERATE"
},
"details": "insane is a whitelist-oriented HTML sanitizer. Versions 2.6.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). As of time of publication, no known patches are available.",
"id": "GHSA-w455-mfq9-hf74",
"modified": "2024-11-13T23:24:39Z",
"published": "2024-10-26T21:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26303"
},
{
"type": "WEB",
"url": "https://github.com/bevacqua/insane/issues/19"
},
{
"type": "PACKAGE",
"url": "https://github.com/bevacqua/insane"
},
{
"type": "ADVISORY",
"url": "https://securitylab.github.com/advisories/GHSL-2020-289-redos-insane"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green",
"type": "CVSS_V4"
}
],
"summary": "insane vulnerable to Regular Expression Denial of Service"
}
GHSA-W4PP-8PJF-RMXW
Vulnerability from github – Published: 2026-05-26 13:30 – Updated: 2026-08-27 16:39
VLAI
Summary
pacote is vulnerable to Denial of Service (DoS) via the addGitSha function
Details
Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.
Severity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "pacote"
},
"ranges": [
{
"events": [
{
"introduced": "11.2.7"
},
{
"fixed": "21.5.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-9496"
],
"database_specific": {
"cwe_ids": [
"CWE-1333",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-27T16:39:41Z",
"nvd_published_at": "2026-05-26T07:16:19Z",
"severity": "HIGH"
},
"details": "Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function\u2019s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.",
"id": "GHSA-w4pp-8pjf-rmxw",
"modified": "2026-08-27T16:39:41Z",
"published": "2026-05-26T13:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9496"
},
{
"type": "WEB",
"url": "https://github.com/npm/pacote/commit/627a7dc1a214d857472a13b48e42559c75288c9e"
},
{
"type": "WEB",
"url": "https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508"
},
{
"type": "PACKAGE",
"url": "https://github.com/npm/pacote"
},
{
"type": "WEB",
"url": "https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2"
},
{
"type": "WEB",
"url": "https://github.com/npm/pacote/releases/tag/v21.5.1"
},
{
"type": "WEB",
"url": "https://github.com/npm/pacote/releases/tag/v22.0.0"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16874025"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-PACOTE-8225084"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "pacote is vulnerable to Denial of Service (DoS) via the addGitSha function"
}
Mitigation
Architecture and Design
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
Mitigation
System Configuration
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Mitigation
Implementation
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
Mitigation
Implementation
Limit the length of the input that the regular expression will process.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.