Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

CVEs (485)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-16215 1Zulip 1Zulip Server Jun 17, 2026 Sep 18, 2019 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into the server could send a crafted message causing the server to spend an effectiv...Show more The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into the server could send a crafted message causing the server to spend an effectively arbitrary amount of CPU time and stall the processing of future messages.Show less
CVE-2019-12041 1Remarkable Project 1Remarkable Jun 17, 2026 May 13, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section.
CVE-2017-16021 1Garycourt 1Uri Js Nov 21, 2024 Jun 4, 2018 N/A· v4 6.5 MEDIUM· v3 6.8 MEDIUM· v2 uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulne...Show more uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100% usage while uri-js is trying to validate if the supplied URL is valid or not. To check if you're vulnerable, look for a call to `require("uri-js").parse()` where a user is able to send their own input. This affects uri-js 2.1.1 and earlier.Show less
CVE-2015-8854 2Fedoraproject Marked Project 2Fedora Marked May 13, 2026 Jan 23, 2017 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular...Show more The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular expression denial of service (ReDoS)."Show less
CVE-2015-8315 1Vercel 1Ms May 13, 2026 Jan 23, 2017 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."

Previous 1...21 22 23 2425