Common Weakness Enumeration

CWE-1333 Inefficient Regular Expression Complexity

Description

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Associated Reviewed Advisories

Vulnerabilities classified under CWE-1333 ordered by modification date.

25 reviewed records
Advisory ID NVD ID Severity PURLs Summary Last Modified
GHSA-524c-h47v-m3h8 CVE-2026-104150 MODERATE

AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity

2026-10-15
GHSA-8pqf-f4m5-798g CVE-2026-106454 MODERATE

Twisted: IMAP wildcardToRegexp() ReDoS

2026-10-15
GHSA-fpf4-vwcp-v4hp CVE-2026-107290 MODERATE

Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`

2026-10-08
GHSA-9m4w-fmjw-fvjq CVE-2026-105645 MODERATE

Ghost: Regular Expression Denial of Service in External Media Inliner

2026-10-07
GHSA-fwh9-qg68-vxp4 CVE-2026-105646 MODERATE

Ghost: Regular Expression Denial of Service in Content Import

2026-10-07
GHSA-68jq-fhch-4xq4 CVE-2026-106104 HIGH

Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

2026-10-07
GHSA-2g7p-5934-q4w7 CVE-2026-105854 HIGH

Payload: ReDoS in Multipart Content-Type Validation

2026-10-06
GHSA-6h2x-m376-mqjq CVE-2026-92599 HIGH

joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`

2026-10-05
GHSA-mrx9-2rrp-rhpx - HIGH

Duplicate Advisory: joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`

2026-10-05
GHSA-gjj5-9665-rwrc CVE-2026-104861 HIGH

probe-image-size: Quadratic-time Denial of Service in the SVG Parser

2026-10-02
GHSA-mhvh-fq92-pfmr CVE-2026-77387 MODERATE

geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point

2026-10-02
GHSA-p6pp-m3f8-5c89 CVE-2026-89407 HIGH

jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()

2026-10-01
GHSA-c475-qrg2-pj4r CVE-2026-102990 HIGH

basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

2026-10-01
GHSA-g5vv-9gxw-82hx CVE-2026-87819 HIGH

GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing

2026-09-30
GHSA-qpf5-3wfw-fh7q - HIGH

Duplicate Advisory: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing

2026-09-30
GHSA-c29m-xwm3-cm6r CVE-2026-101903 HIGH

Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

2026-09-30
GHSA-mghh-pgcx-3jjj CVE-2026-101906 HIGH

Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

2026-09-30
GHSA-jwrc-g2q2-pq5p CVE-2026-102270 MODERATE

PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

2026-09-30
GHSA-v53p-9fqp-m79j - HIGH

Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service

2026-09-29
GHSA-jgm3-qmp2-c4p7 CVE-2026-63460 HIGH

Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends

2026-09-25
GHSA-ph9c-7hw9-vhhw CVE-2026-77421 MODERATE

JLine: ReDoS in Nano Editor Regex Search Mode

2026-09-23
GHSA-r2xf-8xr9-62gw CVE-2026-77422 HIGH

JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping

2026-09-23
GHSA-5q95-hrpc-m3w3 CVE-2026-77420 MODERATE

JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable

2026-09-23
GHSA-jx63-h26r-8cph CVE-2026-58270 MODERATE

Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`

2026-09-22
GHSA-gjv8-xp57-g29c CVE-2026-86000 MODERATE

Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns

2026-09-17