Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

CVEs (551)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-23446 1Handsontable 1Handsontable Jun 17, 2026 Sep 29, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The package handsontable before 10.0.0; the package handsontable from 0 and before 10.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) in Handsontable.helper.isNumeric function.
CVE-2021-3828 1Nltk 1Nltk Jun 17, 2026 Sep 27, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 nltk is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3822 1Jsoneditoronline 1Jsoneditor Jun 17, 2026 Sep 27, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 jsoneditor is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3820 1Inflect Project 1Inflect Jun 17, 2026 Sep 27, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 inflect is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3810 1Coder 1Code Server Jun 17, 2026 Sep 17, 2021 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 code-server is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3807 2Ansi Regex Project Oracle 2Ansi Regex Communications Cloud Native Core Policy Oct 8, 2026 Sep 17, 2021 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 ansi-regex is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3804 1Taro 1Taro Jun 17, 2026 Sep 17, 2021 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 taro is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3803 2Debian Nth Check Project 2Debian Linux Nth Check Jun 17, 2026 Sep 17, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 nth-check is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3795 1Semver Regex Project 1Semver Regex Jun 17, 2026 Sep 15, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 semver-regex is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3801 1Prismjs 1Prism Jun 17, 2026 Sep 15, 2021 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 prism is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3794 1Vuelidate Project 1Vuelidate Jun 17, 2026 Sep 15, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 vuelidate is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3777 1Tmpl Project 1Tmpl Jun 17, 2026 Sep 15, 2021 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 nodejs-tmpl is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3749 3Axios OracleSiemens 3Axios GoldengateSinec Ins Jun 17, 2026 Aug 31, 2021 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 axios is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-3649 1Chatwoot 1Chatwoot Jun 17, 2026 Jul 16, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 chatwoot is vulnerable to Inefficient Regular Expression Complexity
CVE-2020-1920 1Facebook 1React Native Jun 17, 2026 Jun 1, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native versio...Show more A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1.Show less
CVE-2021-33502 1Normalize Url Project 1Normalize Url Jun 17, 2026 May 24, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
CVE-2021-23364 1Browserslist Project 1Browserslist Jun 17, 2026 Apr 28, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.
CVE-2021-23382 1Postcss 1Postcss Jun 17, 2026 Apr 26, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pat...Show more The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\\s sourceMappingURL=(.*).Show less
CVE-2021-23362 2Npmjs Siemens 2Hosted Git Info Sinec Infrastructure Network Services Jun 17, 2026 Mar 23, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits p...Show more The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.Show less
CVE-2021-25292 1Python 1Pillow Jun 17, 2026 Mar 19, 2021 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.

Previous 1...24 25 262728 Next