Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

CVEs (551)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-40901 1Scniro Validator Project 1Scniro Validator Jun 17, 2026 Jun 27, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scniro-validator v1.0.1 when validating crafted invalid emails.
CVE-2021-40900 1Regexfn Project 1Regexfn Jun 17, 2026 Jun 27, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in regexfn v1.0.5 when validating crafted invalid emails.
CVE-2021-40899 1Repo Git Downloader Project 1Repo Git Downloader Jun 17, 2026 Jun 27, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in repo-git-downloader v0.1.1 when downloading crafted invalid git repositories.
CVE-2021-40898 1Scaffold Helper Project 1Scaffold Helper Jun 17, 2026 Jun 27, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scaffold-helper v1.2.0 when copying crafted invalid files.
CVE-2021-40897 1Split Html To Chars Project 1Split Html To Chars Jun 17, 2026 Jun 27, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in split-html-to-chars v1.0.5 when splitting crafted invalid htmls.
CVE-2021-40896 1That Value Project 1That Value Jun 17, 2026 Jun 27, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in that-value v0.1.3 when validating crafted invalid emails.
CVE-2021-40895 1Todo Regex Project 1Todo Regex Jun 17, 2026 Jun 27, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in todo-regex v0.1.1 when matching crafted invalid TODO statements.
CVE-2021-40894 1Underscore 99xp Project 1Underscore 99xp Jun 17, 2026 Jun 24, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in underscore-99xp v1.7.2 when the deepValueSearch function is called.
CVE-2021-40893 1Validate Data Project 1Validate Data Jun 17, 2026 Jun 24, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-data v0.1.1 when validating crafted invalid emails.
CVE-2021-40892 1Validate Color Project 1Validate Color Jun 17, 2026 Jun 24, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-color v2.1.0 when handling crafted invalid rgb(a) strings.
CVE-2021-46823 1Python Ldap 1Python Ldap Jun 17, 2026 Jun 18, 2022 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. By sendin...Show more python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. By sending crafted regex input, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition.Show less
CVE-2021-40660 1Javadelight 1Nashorn Sandbox Jun 17, 2026 Jun 14, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in Delight Nashorn Sandbox 0.2.0. There is an ReDoS vulnerability that can be exploited to launching a denial of service (DoS) attack.
CVE-2022-1929 1Devcert Project 1Devcert Jun 17, 2026 Jun 2, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to the certificateFor method
CVE-2021-43308 1Markdown Link Extractor Project 1Markdown Link Extractor Jun 17, 2026 Jun 2, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function
CVE-2021-43307 1Semver Regex Project 1Semver Regex Jun 17, 2026 Jun 2, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method
CVE-2021-43306 1Jqueryvalidation 1Jquery Validation Jun 17, 2026 Jun 2, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method
CVE-2022-29169 1Bigbluebutton 1Bigbluebutton Jun 17, 2026 Jun 1, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnerable to regular expression denial of service (ReDoS) attacks. By using specific a...Show more BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnerable to regular expression denial of service (ReDoS) attacks. By using specific a RegularExpression, an attacker can cause denial of service for the bbb-html5 service. The useragent library performs checking of device by parsing the input of User-Agent header and lets it go through lookupUserAgent() (alias of useragent.lookup() ). This function handles input by regexing and attackers can abuse that by providing some ReDos payload using `SmartWatch`. The maintainers removed `htmlclient/useragent` from versions 2.3.19, 2.4.7, and 2.5.0-beta.2. As a workaround, disable NginX forwarding the requests to the handler according to the directions in the GitHub Security Advisory.Show less
CVE-2022-21195 1Url Regex Project 1Url Regex Jun 17, 2026 May 20, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 All versions of package url-regex are vulnerable to Regular Expression Denial of Service (ReDoS) which can cause the CPU usage to crash.
CVE-2022-26650 1Apache 1Shenyu Jun 17, 2026 May 17, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacke...Show more In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource exhaustion. This issue affects Apache ShenYu (incubating) 2.4.0, 2.4.1 and 2.4.2 and is fixed in 2.4.3.Show less
CVE-2022-1510 1Gitlab 1Gitlab Jun 17, 2026 May 11, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue has been discovered in GitLab affecting all versions starting from 13.9 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly han...Show more An issue has been discovered in GitLab affecting all versions starting from 13.9 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly handling malicious text in the CI Editor and CI Pipeline details page allowing the attacker to cause uncontrolled resource consumption.Show less

Previous 1...242526 27 28 Next