CWE-1333
485 CVEs • Abstraction: Base • Likelihood of Exploit: High
Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVEs (485)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
taro is vulnerable to Inefficient Regular Expression Complexity |
2Debian Nth Check Project2Debian Linux Nth CheckJun 17, 2026 Sep 17, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 nth-check is vulnerable to Inefficient Regular Expression Complexity |
1Semver Regex Project 1Semver Regex Jun 17, 2026 Sep 15, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 semver-regex is vulnerable to Inefficient Regular Expression Complexity |
prism is vulnerable to Inefficient Regular Expression Complexity |
vuelidate is vulnerable to Inefficient Regular Expression Complexity |
nodejs-tmpl is vulnerable to Inefficient Regular Expression Complexity |
3Axios OracleSiemens3Axios GoldengateSinec InsJun 17, 2026 Aug 31, 2021 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 axios is vulnerable to Inefficient Regular Expression Complexity |
chatwoot is vulnerable to Inefficient Regular Expression Complexity |
A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native versio...Show more |
1Normalize Url Project 1Normalize Url Jun 17, 2026 May 24, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs. |
1Browserslist Project 1Browserslist Jun 17, 2026 Apr 28, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries. |
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pat...Show more |
2Npmjs Siemens2Hosted Git Info Sinec Infrastructure Network ServicesJun 17, 2026 Mar 23, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits p...Show more |
An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex. |
3Debian FedoraprojectPygments3Debian Linux FedoraPygmentsJun 17, 2026 Mar 17, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to...Show more |
The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker provides a malicious string, is-svg will get stuck processin...Show more |
The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string /\%(?:\(([\w_.]+)\)|([1-9]\d*)\$)?([0 +\-\]*)(\*|\d+)?(\.)?(\*|\d+)?[hlL]?([\%bscdeEfFgGioOuxX])/g in li...Show more |
2Fedoraproject Markdown2 Project2Fedora Markdown2Jun 17, 2026 Mar 3, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an extended...Show more |
uap-core in an open-source npm package which contains the core of BrowserScope's original user agent string parser. In uap-core before version 0.11.0, some regexes are vulnerable to regular expression denial of service (...Show more |
uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups....Show more |