CWE-1333 Inefficient Regular Expression Complexity
Description
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-1333 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-524c-h47v-m3h8 | CVE-2026-104150 | MODERATE |
AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity |
2026-10-15 | |
| GHSA-8pqf-f4m5-798g | CVE-2026-106454 | MODERATE |
Twisted: IMAP wildcardToRegexp() ReDoS |
2026-10-15 | |
| GHSA-fpf4-vwcp-v4hp | CVE-2026-107290 | MODERATE |
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch` |
2026-10-08 | |
| GHSA-9m4w-fmjw-fvjq | CVE-2026-105645 | MODERATE |
Ghost: Regular Expression Denial of Service in External Media Inliner |
2026-10-07 | |
| GHSA-fwh9-qg68-vxp4 | CVE-2026-105646 | MODERATE |
Ghost: Regular Expression Denial of Service in Content Import |
2026-10-07 | |
| GHSA-68jq-fhch-4xq4 | CVE-2026-106104 | HIGH |
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server |
2026-10-07 | |
| GHSA-2g7p-5934-q4w7 | CVE-2026-105854 | HIGH |
Payload: ReDoS in Multipart Content-Type Validation |
2026-10-06 | |
| GHSA-6h2x-m376-mqjq | CVE-2026-92599 | HIGH |
joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()` |
2026-10-05 | |
| GHSA-mrx9-2rrp-rhpx | - | HIGH |
Duplicate Advisory: joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()` |
2026-10-05 | |
| GHSA-gjj5-9665-rwrc | CVE-2026-104861 | HIGH |
probe-image-size: Quadratic-time Denial of Service in the SVG Parser |
2026-10-02 | |
| GHSA-mhvh-fq92-pfmr | CVE-2026-77387 | MODERATE |
geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point |
2026-10-02 | |
| GHSA-p6pp-m3f8-5c89 | CVE-2026-89407 | HIGH |
jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() |
2026-10-01 | |
| GHSA-c475-qrg2-pj4r | CVE-2026-102990 | HIGH |
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking) |
2026-10-01 | |
| GHSA-g5vv-9gxw-82hx | CVE-2026-87819 | HIGH |
GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing |
2026-09-30 | |
| GHSA-qpf5-3wfw-fh7q | - | HIGH |
Duplicate Advisory: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing |
2026-09-30 | |
| GHSA-c29m-xwm3-cm6r | CVE-2026-101903 | HIGH |
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) |
2026-09-30 | |
| GHSA-mghh-pgcx-3jjj | CVE-2026-101906 | HIGH |
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location |
2026-09-30 | |
| GHSA-jwrc-g2q2-pq5p | CVE-2026-102270 | MODERATE |
PyJWT: ReDoS vulnerability when calling the `is_pem_format` function. |
2026-09-30 | |
| GHSA-v53p-9fqp-m79j | - | HIGH |
Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service |
2026-09-29 | |
| GHSA-jgm3-qmp2-c4p7 | CVE-2026-63460 | HIGH |
Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends |
2026-09-25 | |
| GHSA-ph9c-7hw9-vhhw | CVE-2026-77421 | MODERATE |
JLine: ReDoS in Nano Editor Regex Search Mode |
2026-09-23 | |
| GHSA-r2xf-8xr9-62gw | CVE-2026-77422 | HIGH |
JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping |
2026-09-23 | |
| GHSA-5q95-hrpc-m3w3 | CVE-2026-77420 | MODERATE |
JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable |
2026-09-23 | |
| GHSA-jx63-h26r-8cph | CVE-2026-58270 | MODERATE |
Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters` |
2026-09-22 | |
| GHSA-gjv8-xp57-g29c | CVE-2026-86000 | MODERATE |
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns |
2026-09-17 |