CWE-1333 · Inefficient Regular Expression Complexity (page 3)
Page 3 of 6 — CVEs classified under CWE-1333, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-4727 | Low | 3.7 | 2025-05-15 | A vulnerability was found in Meteor up to 3.2.1 and classified as problematic. This issue affects the function Object.assign of the file packages/ddp-server/li… |
CVE-2025-24026 | Medium | 5.3 | 2025-05-14 | iTop is an web based IT Service Management tool. Versions prior to 3.2.1 are vulnerable to regular expression denial of service (ReDoS) that may, under some ci… |
CVE-2025-4215 | Low | 3.1 | 2025-05-02 | A vulnerability was found in gorhill uBlock Origin up to 1.63.3b16. It has been classified as problematic. Affected is the function currentStateChanged of the… |
CVE-2025-46560 | Medium | 6.5 | 2025-04-30 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.8.0 and prior to 0.8.5 are affected by a critica… |
CVE-2025-1194 | Medium | 6.5 | 2025-04-29 | A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file `tokenization_gpt… |
CVE-2025-3986 | Medium | 4.3 | 2025-04-27 | A vulnerability was found in Apereo CAS 5.2.6. It has been declared as problematic. This vulnerability affects unknown code of the file cas-5.2.6\core\cas-serv… |
CVE-2025-3985 | Low | 2.7 | 2025-04-27 | A vulnerability was found in Apereo CAS 5.2.6. It has been classified as problematic. This affects the function ResponseEntity of the file cas-5.2.6\webapp-mgm… |
CVE-2025-2811 | Medium | 5.7 | 2025-04-26 | A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT180… |
CVE-2024-13926 | High | 7.5 | 2025-04-19 | The WP-Syntax WordPress plugin through 1.2 does not properly handle input, allowing an attacker to create a post containing a large number of tags, thereby exp… |
CVE-2024-13896 | Medium | 6.5 | 2025-04-10 | The WP-GeSHi-Highlight — rock-solid syntax highlighting for 259 languages WordPress plugin through 1.4.3 processes user-supplied input as a regular expression… |
CVE-2023-0881 | High | 7.5 | 2025-03-31 | Running DDoS on tcp port 22 will trigger a kernel crash. This issue is introduced by the backport of a commit regarding nft_lookup without the subsequent fixes… |
CVE-2025-2833 | Medium | 5.3 | 2025-03-27 | A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been classified as problematic. Affected is an unknown function of the component HTTP Header… |
CVE-2024-8998 | High | 7.5 | 2025-03-20 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in lunary-ai/lunary version git f07a845. The server uses the regex /{.*?}/ to match user-co… |
CVE-2024-8789 | High | 7.5 | 2025-03-20 | Lunary-ai/lunary version git 105a3f6 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. The application allows users to upload their own r… |
CVE-2024-8764 | High | 7.5 | 2025-03-20 | A vulnerability in lunary-ai/lunary, as of commit be54057, allows users to upload and execute arbitrary regular expressions on the server side. This can lead t… |
CVE-2024-8763 | High | 7.5 | 2025-03-20 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in the lunary-ai/lunary repository, specifically in the compileTextTemplate function. The a… |
CVE-2024-7779 | High | 7.5 | 2025-03-20 | A vulnerability in danswer-ai/danswer version 1 allows an attacker to perform a Regular Expression Denial of Service (ReDoS) by manipulating regular expression… |
CVE-2024-12720 | High | 7.5 | 2025-03-20 | A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenization_noug… |
CVE-2024-12391 | Medium | 6.5 | 2025-03-20 | A vulnerability in binary-husky/gpt_academic, as of commit 310122f, allows for a Regular Expression Denial of Service (ReDoS) attack. The function '解析项目源码（手动指定… |
CVE-2024-12388 | Medium | 6.5 | 2025-03-20 | A vulnerability in binary-husky/gpt_academic version 310122f allows for a Regular Expression Denial of Service (ReDoS) attack. The application uses a regular e… |
CVE-2024-10955 | Medium | 6.5 | 2025-03-20 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in gaizhenbiao/chuanhuchatgpt, as of commit 20b2e02. The server uses the regex pattern `r'<… |
CVE-2024-10624 | High | 7.5 | 2025-03-20 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the gr.Datetime component. The affected vers… |
CVE-2024-10550 | High | 7.5 | 2025-03-20 | A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specif… |
CVE-2024-10549 | High | 7.5 | 2025-03-20 | A vulnerability in the `/3/Parse` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint uses a user-specified stri… |
CVE-2025-26042 | Medium | 6.0 | 2025-03-17 | Uptime Kuma >== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. If a string is provided it… |
CVE-2025-27789 | Medium | 6.2 | 2025-03-11 | Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression name… |
CVE-2025-27220 | Medium | 4.0 | 2025-03-04 | In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method. |
CVE-2024-54170 | Medium | 5.5 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to cause a denial of service due to use of a regular expression with an inefficient complexity that consumes excessiv… |
CVE-2025-25290 | Medium | 5.3 | 2025-02-14 | @octokit/request sends parameterized requests to GitHub’s APIs with sensible defaults in browsers and Node. Starting in version 1.0.0 and prior to versions 9.2… |
CVE-2025-25289 | Medium | 5.3 | 2025-02-14 | @octokit/request-error is an error class for Octokit request errors. Starting in version 1.0.0 and prior to version 6.1.7, a Regular Expression Denial of Servi… |
CVE-2025-25288 | Medium | 5.3 | 2025-02-14 | @octokit/plugin-paginate-rest is the Octokit plugin to paginate REST API endpoint responses. For versions starting in 1.0.0 and prior to 11.4.1 of the npm pack… |
CVE-2025-25285 | Medium | 5.3 | 2025-02-14 | @octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version 10.1.3, by crafting specific `options`… |
CVE-2025-25283 | High | 7.5 | 2025-02-12 | parse-duraton is software that allows users to convert a human readable duration to milliseconds. Versions prior to 2.1.3 are vulnerable to an event loop delay… |
CVE-2025-25200 | High | 7.5 | 2025-02-12 | Koa is expressive middleware for Node.js using ES2017 async functions. Prior to versions 0.21.2, 1.7.1, 2.15.4, and 3.0.0-alpha.3, Koa uses an evil regex to pa… |
CVE-2025-0367 | Medium | 6.5 | 2025-01-30 | In versions 3.1.0 and lower of the Splunk Supporting Add-on for Active Directory, also known as SA-ldapsearch, a vulnerable regular expression pattern could le… |
CVE-2024-36751 | Medium | 6.5 | 2025-01-15 | An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL. |
CVE-2024-46242 | High | 7.5 | 2025-01-07 | An issue in the validate_email function in CTFd/utils/validators/__init__.py of CTFd 3.7.3 allows attackers to cause a Regular expression Denial of Service (Re… |
CVE-2024-41766 | High | 7.5 | 2025-01-04 | IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to cause a denial of service using a complex regular express… |
CVE-2024-45338 | Medium | 5.3 | 2024-12-18 | An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. Thi… |
CVE-2024-52798 | | 2024-12-05 | path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause… | |
CVE-2024-54157 | Medium | 4.3 | 2024-12-04 | In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detector |
CVE-2024-10270 | Medium | 6.5 | 2024-11-25 | A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (D… |
CVE-2024-21539 | High | 7.5 | 2024-11-19 | Versions of the package @eslint/plugin-kit before 0.2.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An a… |
CVE-2024-52524 | | 2024-11-14 | Giskard is an evaluation and testing framework for AI systems. A Remote Code Execution (ReDoS) vulnerability was discovered in Giskard component by the GitHub… | |
CVE-2024-21538 | High | 7.5 | 2024-11-08 | Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper in… |
CVE-2024-49761 | High | 7.5 | 2024-10-28 | REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex… |
CVE-2024-50574 | Medium | 5.3 | 2024-10-28 | In JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionality |
CVE-2020-26311 | High | 7.5 | 2024-10-26 | Useragent is a user agent parser for Node.js. All versions as of time of publication contain one or more regular expressions that are vulnerable to Regular Exp… |
CVE-2020-26310 | | 2024-10-26 | Validate.js provides a declarative way of validating javascript objects. All versions as of 30 November 2020 contain one or more regular expressions that are v… | |
CVE-2020-26309 | | 2024-10-26 | Validate.js provides a declarative way of validating javascript objects. Versions 0.11.3 and prior contain one or more regular expressions that are vulnerable… | |
CVE-2020-26308 | High | 7.5 | 2024-10-26 | Validate.js provides a declarative way of validating javascript objects. Versions 0.13.1 and prior contain one or more regular expressions that are vulnerable… |
CVE-2020-26307 | | 2024-10-26 | HTML2Markdown is a Javascript implementation for converting HTML to Markdown text. All available versions contain one or more regular expressions that are vuln… | |
CVE-2020-26306 | | 2024-10-26 | Knwl.js is a Javascript library that parses through text for dates, times, phone numbers, emails, places, and more. Versions 1.0.2 and prior contain one or mor… | |
CVE-2020-26305 | High | 7.5 | 2024-10-26 | CommonRegexJS is a CommonRegex port for JavaScript. All available versions contain one or more regular expressions that are vulnerable to Regular Expression De… |
CVE-2020-26304 | High | 7.5 | 2024-10-26 | Foundation is a front-end framework. Versions 6.3.3 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Servi… |
CVE-2020-26303 | High | 7.5 | 2024-10-26 | insane is a whitelist-oriented HTML sanitizer. Versions 2.6.2 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denia… |
CVE-2024-47889 | | 2024-10-16 | Action Mailer is a framework for designing email service layers. Starting in version 3.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there… | |
CVE-2024-47888 | | 2024-10-16 | Action Text brings rich text content and editing to Rails. Starting in version 6.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a p… | |
CVE-2024-47887 | | 2024-10-16 | Action Pack is a framework for handling and responding to web requests. Starting in version 4.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1… | |
CVE-2024-9506 | Low | 3.7 | 2024-10-15 | Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability. |
CVE-2024-48938 | High | 7.5 | 2024-10-11 | Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows DoS/ReDos via email. Parsing the content of emails where HTML code is copied from Microso… |
CVE-2024-25885 | High | 7.5 | 2024-10-08 | An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a cra… |
CVE-2024-9277 | Low | 3.5 | 2024-09-27 | A vulnerability classified as problematic was found in Langflow up to 1.0.18. Affected by this vulnerability is an unknown functionality of the file \src\backe… |
CVE-2024-45813 | Medium | 5.3 | 2024-09-18 | find-my-way is a fast, open source HTTP router, internally using a Radix Tree (aka compact Prefix Tree), supports route params, wildcards, and it's framework i… |
CVE-2024-45801 | High | 7.3 | 2024-09-16 | DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting tec… |
CVE-2024-8124 | High | 7.5 | 2024-09-12 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.1.7, starting from 17.2 prior to 17.2.5, starting from 17.3 prior… |
CVE-2024-45296 | High | 7.5 | 2024-09-09 | path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause… |
CVE-2024-6232 | High | 7.5 | 2024-09-03 | There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing… |
CVE-2023-7279 | Low | 2.6 | 2024-09-02 | A vulnerability has been found in Secure Systems Engineering Connaisseur up to 3.3.0 and classified as problematic. This vulnerability affects unknown code of… |
CVE-2020-36830 | Medium | 4.3 | 2024-09-02 | A vulnerability was found in nescalante urlregex up to 0.5.0 and classified as problematic. This issue affects some unknown processing of the file index.js of… |
CVE-2024-7592 | High | 7.5 | 2024-08-19 | There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backsla… |
CVE-2024-3114 | Medium | 4.3 | 2024-08-08 | An issue was discovered in GitLab CE/EE affecting all versions starting from 11.10 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2, with the pr… |
CVE-2024-2800 | Medium | 6.5 | 2024-08-08 | ReDoS flaw in RefMatcher when matching branch names using wildcards in GitLab EE/CE affecting all versions from 11.3 prior to 17.0.6, 17.1 prior to 17.1.4, and… |
CVE-2024-41818 | High | 7.5 | 2024-07-29 | fast-xml-parser is an open source, pure javascript xml parser. a ReDOS exists on currency.js. This vulnerability is fixed in 4.4.1. |
CVE-2024-41655 | High | 7.5 | 2024-07-23 | TF2 Item Format helps users format TF2 items to the community standards. Versions of `tf2-item-format` since at least `4.2.6` and prior to `5.9.14` are vulner… |
CVE-2024-39317 | Medium | 6.5 | 2024-07-11 | Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a long time to process s… |
CVE-2024-3651 | High | 7.5 | 2024-07-07 | A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the func… |
CVE-2024-6434 | Low | 3.1 | 2024-07-04 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 4.10… |
CVE-2024-39316 | Medium | 6.5 | 2024-07-02 | Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.5, Regular Expression Denial of Service (ReDoS) vulnerability e… |
CVE-2024-39249 | High | 7.5 | 2024-07-01 | Async <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function. NOTE: this is dispute… |
CVE-2024-6038 | High | 7.5 | 2024-06-27 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability is located in the fi… |
CVE-2024-1493 | Medium | 6.5 | 2024-06-27 | An issue was discovered in GitLab CE/EE affecting all versions starting from 9.2 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 p… |
CVE-2024-1963 | Medium | 6.5 | 2024-06-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.4 prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from… |
CVE-2024-1736 | Medium | 6.5 | 2024-06-12 | An issue has been discovered in GitLab CE/EE affecting all versions prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17… |
CVE-2024-1495 | Medium | 6.5 | 2024-06-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.1 prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting fro… |
CVE-2024-5552 | High | 7.5 | 2024-06-06 | kubeflow/kubeflow is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to inefficient regular expression complexity in its email validati… |
CVE-2024-4148 | High | 7.5 | 2024-06-01 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in the lunary-ai/lunary application, version 1.2.10. An attacker can exploit this vulnerabi… |
CVE-2023-6502 | Medium | 4.3 | 2024-05-23 | A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17… |
CVE-2024-4067 | Medium | 5.3 | 2024-05-14 | The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in… |
CVE-2024-2651 | Medium | 6.5 | 2024-05-14 | An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from… |
CVE-2023-6688 | Medium | 6.5 | 2024-05-14 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.11 prior to 16.11.2. A problem with the processing logic for Google Chat M… |
CVE-2023-6682 | Medium | 6.5 | 2024-05-14 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from… |
CVE-2024-28716 | High | 7.5 | 2024-04-30 | An issue in OpenStack Storlets yoga-eom allows a remote attacker to execute arbitrary code via the gateway.py component. |
CVE-2024-4056 | High | 7.5 | 2024-04-26 | Denial of service condition in M-Files Server in versions before 24.4.13592.4 and after 23.11 (excluding 24.2 LTS) allows unauthenticated user to consume compu… |
CVE-2024-2829 | High | 7.5 | 2024-04-25 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.5 before 16.9.6, all versions starting from 16.10 before 16.10.4, all vers… |
CVE-2024-22640 | High | 7.5 | 2024-04-19 | TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color. |
CVE-2024-3772 | Medium | 5.9 | 2024-04-15 | Regular expression denial of service in Pydanic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service via a crafted email string. |
CVE-2023-6678 | Medium | 4.3 | 2024-04-12 | An issue has been discovered in GitLab EE affecting all versions before 16.8.6, all versions starting from 16.9 before 16.9.4, all versions starting from 16.10… |
CVE-2023-6489 | Medium | 4.3 | 2024-04-12 | A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 which allows… |
CVE-2024-22363 | High | 7.5 | 2024-04-05 | SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS). |