Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

CVEs (454)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-25758 1Scss Tokenizer Project 1Scss Tokenizer Jun 17, 2026 Jul 1, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of insecure regex.
CVE-2022-1954 1Gitlab 1Gitlab Jun 17, 2026 Jul 1, 2022 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 A Regular Expression Denial of Service vulnerability in GitLab CE/EE affecting all versions from 1.0.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to make a GitLab instance inacces...Show more A Regular Expression Denial of Service vulnerability in GitLab CE/EE affecting all versions from 1.0.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to make a GitLab instance inaccessible via specially crafted web server response headersShow less
CVE-2022-31110 1Rsshub 1Rsshub Jun 17, 2026 Jun 29, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 RSSHub is an open source, extensible RSS feed generator. In commits prior to 5c4177441417 passing some special values to the `filter` and `filterout` parameters can cause an abnormally high CPU. This results in an impact...Show more RSSHub is an open source, extensible RSS feed generator. In commits prior to 5c4177441417 passing some special values to the `filter` and `filterout` parameters can cause an abnormally high CPU. This results in an impact on the performance of the servers and RSSHub services which may lead to a denial of service. This issue has been fixed in commit 5c4177441417 and all users are advised to upgrade. There are no known workarounds for this issue.Show less
CVE-2021-40901 1Scniro Validator Project 1Scniro Validator Jun 17, 2026 Jun 27, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scniro-validator v1.0.1 when validating crafted invalid emails.
CVE-2021-40900 1Regexfn Project 1Regexfn Jun 17, 2026 Jun 27, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in regexfn v1.0.5 when validating crafted invalid emails.
CVE-2021-40899 1Repo Git Downloader Project 1Repo Git Downloader Jun 17, 2026 Jun 27, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in repo-git-downloader v0.1.1 when downloading crafted invalid git repositories.
CVE-2021-40898 1Scaffold Helper Project 1Scaffold Helper Jun 17, 2026 Jun 27, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scaffold-helper v1.2.0 when copying crafted invalid files.
CVE-2021-40897 1Split Html To Chars Project 1Split Html To Chars Jun 17, 2026 Jun 27, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in split-html-to-chars v1.0.5 when splitting crafted invalid htmls.
CVE-2021-40896 1That Value Project 1That Value Jun 17, 2026 Jun 27, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in that-value v0.1.3 when validating crafted invalid emails.
CVE-2021-40895 1Todo Regex Project 1Todo Regex Jun 17, 2026 Jun 27, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in todo-regex v0.1.1 when matching crafted invalid TODO statements.
CVE-2021-40894 1Underscore 99xp Project 1Underscore 99xp Jun 17, 2026 Jun 24, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in underscore-99xp v1.7.2 when the deepValueSearch function is called.
CVE-2021-40893 1Validate Data Project 1Validate Data Jun 17, 2026 Jun 24, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-data v0.1.1 when validating crafted invalid emails.
CVE-2021-40892 1Validate Color Project 1Validate Color Jun 17, 2026 Jun 24, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-color v2.1.0 when handling crafted invalid rgb(a) strings.
CVE-2021-46823 1Python Ldap 1Python Ldap Jun 17, 2026 Jun 18, 2022 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. By sendin...Show more python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. By sending crafted regex input, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition.Show less
CVE-2021-40660 1Javadelight 1Nashorn Sandbox Jun 17, 2026 Jun 14, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in Delight Nashorn Sandbox 0.2.0. There is an ReDoS vulnerability that can be exploited to launching a denial of service (DoS) attack.
CVE-2022-1929 1Devcert Project 1Devcert Jun 17, 2026 Jun 2, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to the certificateFor method
CVE-2021-43308 1Markdown Link Extractor Project 1Markdown Link Extractor Jun 17, 2026 Jun 2, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function
CVE-2021-43307 1Semver Regex Project 1Semver Regex Jun 17, 2026 Jun 2, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method
CVE-2021-43306 1Jqueryvalidation 1Jquery Validation Jun 17, 2026 Jun 2, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method
CVE-2022-29169 1Bigbluebutton 1Bigbluebutton Jun 17, 2026 Jun 1, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnerable to regular expression denial of service (ReDoS) attacks. By using specific a...Show more BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnerable to regular expression denial of service (ReDoS) attacks. By using specific a RegularExpression, an attacker can cause denial of service for the bbb-html5 service. The useragent library performs checking of device by parsing the input of User-Agent header and lets it go through lookupUserAgent() (alias of useragent.lookup() ). This function handles input by regexing and attackers can abuse that by providing some ReDos payload using `SmartWatch`. The maintainers removed `htmlclient/useragent` from versions 2.3.19, 2.4.7, and 2.5.0-beta.2. As a workaround, disable NginX forwarding the requests to the handler according to the directions in the GitHub Security Advisory.Show less

Previous 1...192021 22 23 Next