CWE-1333 · Inefficient Regular Expression Complexity (page 4)
Page 4 of 6 — CVEs classified under CWE-1333, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-21503 | Medium | 5.3 | 2024-03-19 | Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in… |
CVE-2024-28865 | High | 7.5 | 2024-03-18 | django-wiki is a wiki system for Django. Installations of django-wiki prior to version 0.10.1 are vulnerable to maliciously crafted article content that can ca… |
CVE-2024-28864 | Low | 2.6 | 2024-03-18 | SecureProps is a PHP library designed to simplify the encryption and decryption of property data in objects. A vulnerability in SecureProps version 1.2.0 and 1… |
CVE-2024-27351 | Medium | 5.3 | 2024-03-15 | In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and the truncatewords_htm… |
CVE-2024-26146 | Medium | 5.3 | 2024-02-29 | Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible de… |
CVE-2024-25126 | Medium | 5.3 | 2024-02-29 | Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leadi… |
CVE-2024-1892 | Medium | 6.5 | 2024-02-28 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML… |
CVE-2024-26142 | High | 7.5 | 2024-02-27 | Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispat… |
CVE-2024-27088 | Unrated | | 2024-02-26 | es5-ext contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into `function#copy` or `function#toStringTo… |
CVE-2023-51931 | High | 7.5 | 2024-02-16 | An issue in alanclarke URLite v.3.1.0 allows an attacker to cause a denial of service (DoS) via a crafted payload to the parsing function. |
CVE-2021-4437 | Low | 3.5 | 2024-02-12 | A vulnerability, which was classified as problematic, has been found in dbartholomae lambda-middleware frameguard up to 1.0.4. Affected by this issue is some u… |
CVE-2024-21490 | High | 7.5 | 2024-02-10 | This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-s… |
CVE-2023-6736 | Medium | 6.5 | 2024-02-07 | An issue has been discovered in GitLab EE affecting all versions starting from 11.3 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions… |
CVE-2024-24762 | High | 7.5 | 2024-02-05 | `python-multipart` is a streaming multipart parser for Python. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Ty… |
CVE-2023-6159 | Medium | 6.5 | 2024-01-26 | An issue has been discovered in GitLab CE/EE affecting all versions from 12.7 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 It was possible f… |
CVE-2024-23732 | High | 7.5 | 2024-01-21 | The JSON loader in Embedchain before 0.1.57 allows a ReDoS (regular expression denial of service) via a long string to json.py. |
CVE-2023-29487 | Critical | 9.1 | 2023-12-21 | An issue was discovered in Heimdal Thor agent versions 3.4.2 and before on Windows and 2.6.9 and before on macOS, allows attackers to cause a denial of service… |
CVE-2023-29486 | Critical | 9.8 | 2023-12-21 | An issue was discovered in Heimdal Thor agent versions 3.4.2 and before 3.7.0 on Windows, allows attackers to bypass USB access restrictions, execute arbitrary… |
CVE-2023-50249 | High | 7.5 | 2023-12-20 | Sentry-Javascript is official Sentry SDKs for JavaScript. A ReDoS (Regular expression Denial of Service) vulnerability has been identified in Sentry's Astro SD… |
CVE-2023-48631 | Medium | 5.3 | 2023-12-14 | @adobe/css-tools versions 4.3.1 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attemptin… |
CVE-2023-46402 | High | 7.5 | 2023-11-18 | git-urls 1.0.0 allows ReDOS (Regular Expression Denial of Service) in urls.go. |
CVE-2023-45806 | Medium | 4.3 | 2023-11-10 | Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-p… |
CVE-2023-3909 | Medium | 4.3 | 2023-11-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versio… |
CVE-2023-39619 | High | 7.5 | 2023-10-25 | ReDos in NPMJS Node Email Check v.1.0.4 allows an attacker to cause a denial of service via a crafted string to the scpSyntax component. |
CVE-2023-45813 | Medium | 4.6 | 2023-10-18 | Torbot is an open source tor network intelligence tool. In affected versions the `torbot.modules.validators.validate_link function` uses the python-validators… |
CVE-2023-4316 | High | 7.5 | 2023-09-28 | Zod in versions 3.21.0 up to and including 3.22.3 allows an attacker to perform a denial of service while validating emails. |
CVE-2023-43646 | High | 8.6 | 2023-09-27 | get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 are subject to a regu… |
CVE-2023-3210 | Medium | 6.5 | 2023-09-01 | An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions st… |
CVE-2023-3205 | Medium | 6.5 | 2023-09-01 | An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions st… |
CVE-2023-39663 | High | 7.5 | 2023-08-29 | Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service (ReDoS) vulnerabilities in MathJax.js via the components pattern and ma… |
CVE-2023-40599 | High | 7.5 | 2023-08-25 | Regular expression Denial-of-Service (ReDoS) exists in multiple add-ons for Mailform Pro CGI 4.3.1.3 and earlier, which allows a remote unauthenticated attacke… |
CVE-2023-3994 | High | 7.5 | 2023-08-02 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all version… |
CVE-2023-3364 | High | 7.5 | 2023-08-02 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versio… |
CVE-2023-0632 | Medium | 6.5 | 2023-08-02 | An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions sta… |
CVE-2023-39174 | Medium | 4.3 | 2023-07-25 | In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackers |
CVE-2023-3446 | Medium | 5.3 | 2023-07-19 | Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex()… |
CVE-2023-3424 | High | 7.5 | 2023-07-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.3 before 15.11.10, all versions starting from 16.0 before 16.0.6, all vers… |
CVE-2023-36543 | Medium | 6.5 | 2023-07-12 | Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use crafted input to make the current request hang. It is recommende… |
CVE-2023-36053 | High | 7.5 | 2023-07-03 | In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial… |
CVE-2023-36617 | Medium | 5.3 | 2023-06-29 | A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an inc… |
CVE-2023-32610 | High | 7.5 | 2023-06-29 | Mailform Pro CGI 4.3.1.2 and earlier allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition. |
CVE-2023-2232 | Medium | 6.5 | 2023-06-28 | An issue has been discovered in GitLab affecting all versions starting from 15.10 before 16.1, leading to a ReDoS vulnerability in the Jira prefix |
CVE-2023-26115 | Medium | 5.3 | 2023-06-22 | All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within… |
CVE-2023-33289 | High | 7.5 | 2023-06-21 | The urlnorm crate through 0.1.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to lib.rs. NOTE: the Supplier disputes this, tak… |
CVE-2022-25883 | Medium | 5.3 | 2023-06-21 | Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data… |
CVE-2023-33290 | High | 7.5 | 2023-06-12 | The git-url-parse crate through 0.4.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to normalize_url in lib.rs, a similar issu… |
CVE-2023-2199 | High | 7.5 | 2023-06-07 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all ver… |
CVE-2023-2198 | High | 7.5 | 2023-06-07 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all vers… |
CVE-2023-34104 | High | 7.5 | 2023-06-06 | fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. S… |
CVE-2023-31606 | High | 7.5 | 2023-06-06 | A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers t… |
CVE-2023-2132 | High | 7.5 | 2023-06-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all ver… |
CVE-2023-33950 | Medium | 6.5 | 2023-05-24 | Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS… |
CVE-2023-32758 | High | 7.5 | 2023-05-15 | giturlparse (aka git-url-parse) through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS (Regular Expression Denial of Service) if parsin… |
CVE-2023-1894 | Medium | 5.3 | 2023-05-04 | A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted cer… |
CVE-2023-30858 | Medium | 5.3 | 2023-04-28 | The Denosaurs emoji package provides emojis for dinosaurs. Starting in version 0.1.0 and prior to version 0.3.0, the reTrimSpace regex has 2nd degree polynomia… |
CVE-2023-30608 | Medium | 5.5 | 2023-04-18 | sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regul… |
CVE-2023-27704 | Medium | 5.5 | 2023-04-12 | Void Tools Everything lower than v1.4.1.1022 was discovered to contain a Regular Expression Denial of Service (ReDoS). |
CVE-2023-26112 | Low | 3.7 | 2023-04-03 | All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). **Note:**… |
CVE-2023-28756 | Medium | 5.3 | 2023-03-31 | A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters… |
CVE-2023-28755 | Medium | 5.3 | 2023-03-31 | A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. I… |
CVE-2023-26118 | Medium | 5.3 | 2023-03-30 | Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> element due to the usage o… |
CVE-2023-26117 | Medium | 5.3 | 2023-03-30 | Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an inse… |
CVE-2023-26116 | Medium | 5.3 | 2023-03-30 | Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the u… |
CVE-2023-26103 | Medium | 5.3 | 2023-02-25 | Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains… |
CVE-2021-32848 | High | 7.5 | 2023-02-20 | Octobox is software for managing GitHub notifications. Prior to pull request (PR) 2807, a user of the system can provide a specifically crafted search query st… |
CVE-2020-6817 | High | 7.5 | 2023-02-16 | bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with a… |
CVE-2023-24807 | High | 7.5 | 2023-02-16 | Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Deni… |
CVE-2020-36661 | Low | 3.5 | 2023-02-12 | A vulnerability was found in Kong lua-multipart 0.5.8-1. It has been declared as problematic. This vulnerability affects the function is_header of the file src… |
CVE-2019-25103 | Medium | 4.3 | 2023-02-12 | A vulnerability has been found in simple-markdown 0.5.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file s… |
CVE-2019-25102 | Medium | 4.3 | 2023-02-12 | A vulnerability, which was classified as problematic, was found in simple-markdown 0.6.0. Affected is an unknown function of the file simple-markdown.js. The m… |
CVE-2023-22799 | High | 7.5 | 2023-02-09 | A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engin… |
CVE-2023-22796 | High | 7.5 | 2023-02-09 | A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the… |
CVE-2023-22795 | High | 7.5 | 2023-02-09 | A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Mat… |
CVE-2023-22792 | High | 7.5 | 2023-02-09 | A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially cr… |
CVE-2022-44572 | High | 7.5 | 2023-02-09 | A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft inp… |
CVE-2022-44571 | High | 7.5 | 2023-02-09 | There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. This could allow an… |
CVE-2022-44570 | High | 7.5 | 2023-02-09 | A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing componen… |
CVE-2023-25167 | Medium | 6.5 | 2023-02-08 | Discourse is an open source discussion platform. In affected versions a malicious user can cause a regular expression denial of service using a carefully craft… |
CVE-2023-25166 | Medium | 5.5 | 2023-02-08 | formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution ti… |
CVE-2018-25079 | Medium | 4.3 | 2023-02-04 | A vulnerability was found in Segmentio is-url up to 1.2.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file i… |
CVE-2023-23925 | High | 8.6 | 2023-02-03 | Switcher Client is a JavaScript SDK to work with Switcher API which is cloud-based Feature Flag. Unsanitized input flows into Strategy match operation (EXIST)… |
CVE-2022-25881 | Medium | 5.3 | 2023-01-31 | This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when t… |
CVE-2023-23621 | High | 8.6 | 2023-01-28 | Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branche… |
CVE-2022-25927 | Medium | 5.3 | 2023-01-26 | Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS)… |
CVE-2023-24038 | High | 7.5 | 2023-01-21 | The HTML-StripScripts module through 1.06 for Perl allows _hss_attval_style ReDoS because of catastrophic backtracking for HTML content with certain style attr… |
CVE-2022-25901 | Medium | 5.3 | 2023-01-18 | Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an inse… |
CVE-2018-25077 | Low | 3.5 | 2023-01-18 | A vulnerability was found in melnaron mel-spintax. It has been rated as problematic. Affected by this issue is some unknown functionality of the file lib/spint… |
CVE-2021-32837 | High | 7.5 | 2023-01-17 | mechanize, a library for automatically interacting with HTTP web servers, contains a regular expression that is vulnerable to regular expression denial of serv… |
CVE-2022-4891 | Low | 3.5 | 2023-01-17 | A vulnerability has been found in Sisimai up to 4.25.14p11 and classified as problematic. This vulnerability affects the function to_plain of the file lib/sisi… |
CVE-2022-4131 | Medium | 4.3 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versio… |
CVE-2022-3514 | Medium | 4.3 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before 15.6.4, all version… |
CVE-2020-36649 | Low | 3.5 | 2023-01-11 | A vulnerability was found in mholt PapaParse up to 5.1.x. It has been classified as problematic. Affected is an unknown function of the file papaparse.js. The… |
CVE-2018-25074 | Low | 3.5 | 2023-01-11 | A vulnerability was found in Prestaul skeemas and classified as problematic. This issue affects some unknown processing of the file validators/base.js. The man… |
CVE-2017-20165 | Low | 3.5 | 2023-01-09 | A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipu… |
CVE-2021-4306 | Low | 3.5 | 2023-01-07 | A vulnerability classified as problematic has been found in cronvel terminal-kit up to 2.1.7. Affected is an unknown function. The manipulation leads to ineffi… |
CVE-2022-23548 | Medium | 6.5 | 2023-01-05 | Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta16 on the `beta` and `tests-passed` bra… |
CVE-2017-20162 | Medium | 4.3 | 2023-01-05 | A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The ma… |
CVE-2021-4305 | Low | 3.5 | 2023-01-05 | A vulnerability was found in Woorank robots-txt-guard. It has been rated as problematic. Affected by this issue is the function makePathPattern of the file lib… |
CVE-2023-22467 | High | 7.5 | 2023-01-04 | Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2… |
CVE-2021-32821 | Medium | 6.2 | 2023-01-03 | MooTools is a collection of JavaScript utilities for JavaScript developers. All known versions include a CSS selector parser that is vulnerable to Regular Expr… |