CWE-1333 · Inefficient Regular Expression Complexity (page 4)
Page 4 of 5 — CVEs classified under CWE-1333, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-2132 | High | 7.5 | 2023-06-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all ver… |
CVE-2023-33950 | Medium | 6.5 | 2023-05-24 | Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS… |
CVE-2023-32758 | High | 7.5 | 2023-05-15 | giturlparse (aka git-url-parse) through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS (Regular Expression Denial of Service) if parsin… |
CVE-2023-1894 | Medium | 5.3 | 2023-05-04 | A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted cer… |
CVE-2023-30858 | Medium | 5.3 | 2023-04-28 | The Denosaurs emoji package provides emojis for dinosaurs. Starting in version 0.1.0 and prior to version 0.3.0, the reTrimSpace regex has 2nd degree polynomia… |
CVE-2023-30608 | Medium | 5.5 | 2023-04-18 | sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regul… |
CVE-2023-27704 | Medium | 5.5 | 2023-04-12 | Void Tools Everything lower than v1.4.1.1022 was discovered to contain a Regular Expression Denial of Service (ReDoS). |
CVE-2023-26112 | Low | 3.7 | 2023-04-03 | All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). **Note:**… |
CVE-2023-28756 | Medium | 5.3 | 2023-03-31 | A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters… |
CVE-2023-28755 | Medium | 5.3 | 2023-03-31 | A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. I… |
CVE-2023-26118 | Medium | 5.3 | 2023-03-30 | Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> element due to the usage o… |
CVE-2023-26117 | Medium | 5.3 | 2023-03-30 | Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an inse… |
CVE-2023-26116 | Medium | 5.3 | 2023-03-30 | Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the u… |
CVE-2023-26103 | Medium | 5.3 | 2023-02-25 | Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains… |
CVE-2021-32848 | High | 7.5 | 2023-02-20 | Octobox is software for managing GitHub notifications. Prior to pull request (PR) 2807, a user of the system can provide a specifically crafted search query st… |
CVE-2020-6817 | High | 7.5 | 2023-02-16 | bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with a… |
CVE-2023-24807 | High | 7.5 | 2023-02-16 | Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Deni… |
CVE-2020-36661 | Low | 3.5 | 2023-02-12 | A vulnerability was found in Kong lua-multipart 0.5.8-1. It has been declared as problematic. This vulnerability affects the function is_header of the file src… |
CVE-2019-25103 | Medium | 4.3 | 2023-02-12 | A vulnerability has been found in simple-markdown 0.5.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file s… |
CVE-2019-25102 | Medium | 4.3 | 2023-02-12 | A vulnerability, which was classified as problematic, was found in simple-markdown 0.6.0. Affected is an unknown function of the file simple-markdown.js. The m… |
CVE-2023-22799 | High | 7.5 | 2023-02-09 | A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engin… |
CVE-2023-22796 | High | 7.5 | 2023-02-09 | A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the… |
CVE-2023-22795 | High | 7.5 | 2023-02-09 | A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Mat… |
CVE-2023-22792 | High | 7.5 | 2023-02-09 | A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially cr… |
CVE-2022-44572 | High | 7.5 | 2023-02-09 | A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft inp… |
CVE-2022-44571 | High | 7.5 | 2023-02-09 | There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. This could allow an… |
CVE-2022-44570 | High | 7.5 | 2023-02-09 | A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing componen… |
CVE-2023-25167 | Medium | 6.5 | 2023-02-08 | Discourse is an open source discussion platform. In affected versions a malicious user can cause a regular expression denial of service using a carefully craft… |
CVE-2023-25166 | Medium | 5.5 | 2023-02-08 | formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution ti… |
CVE-2018-25079 | Medium | 4.3 | 2023-02-04 | A vulnerability was found in Segmentio is-url up to 1.2.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file i… |
CVE-2023-23925 | High | 8.6 | 2023-02-03 | Switcher Client is a JavaScript SDK to work with Switcher API which is cloud-based Feature Flag. Unsanitized input flows into Strategy match operation (EXIST)… |
CVE-2022-25881 | Medium | 5.3 | 2023-01-31 | This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when t… |
CVE-2023-23621 | High | 8.6 | 2023-01-28 | Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and version 3.1.0.beta2 on the `beta` and `tests-passed` branche… |
CVE-2022-25927 | Medium | 5.3 | 2023-01-26 | Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS)… |
CVE-2023-24038 | High | 7.5 | 2023-01-21 | The HTML-StripScripts module through 1.06 for Perl allows _hss_attval_style ReDoS because of catastrophic backtracking for HTML content with certain style attr… |
CVE-2022-25901 | Medium | 5.3 | 2023-01-18 | Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an inse… |
CVE-2018-25077 | Low | 3.5 | 2023-01-18 | A vulnerability was found in melnaron mel-spintax. It has been rated as problematic. Affected by this issue is some unknown functionality of the file lib/spint… |
CVE-2021-32837 | High | 7.5 | 2023-01-17 | mechanize, a library for automatically interacting with HTTP web servers, contains a regular expression that is vulnerable to regular expression denial of serv… |
CVE-2022-4891 | Low | 3.5 | 2023-01-17 | A vulnerability has been found in Sisimai up to 4.25.14p11 and classified as problematic. This vulnerability affects the function to_plain of the file lib/sisi… |
CVE-2022-4131 | Medium | 4.3 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versio… |
CVE-2022-3514 | Medium | 4.3 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before 15.6.4, all version… |
CVE-2020-36649 | Low | 3.5 | 2023-01-11 | A vulnerability was found in mholt PapaParse up to 5.1.x. It has been classified as problematic. Affected is an unknown function of the file papaparse.js. The… |
CVE-2018-25074 | Low | 3.5 | 2023-01-11 | A vulnerability was found in Prestaul skeemas and classified as problematic. This issue affects some unknown processing of the file validators/base.js. The man… |
CVE-2017-20165 | Low | 3.5 | 2023-01-09 | A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipu… |
CVE-2021-4306 | Low | 3.5 | 2023-01-07 | A vulnerability classified as problematic has been found in cronvel terminal-kit up to 2.1.7. Affected is an unknown function. The manipulation leads to ineffi… |
CVE-2022-23548 | Medium | 6.5 | 2023-01-05 | Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta16 on the `beta` and `tests-passed` bra… |
CVE-2017-20162 | Medium | 4.3 | 2023-01-05 | A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The ma… |
CVE-2021-4305 | Low | 3.5 | 2023-01-05 | A vulnerability was found in Woorank robots-txt-guard. It has been rated as problematic. Affected by this issue is the function makePathPattern of the file lib… |
CVE-2023-22467 | High | 7.5 | 2023-01-04 | Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2… |
CVE-2021-32821 | Medium | 6.2 | 2023-01-03 | MooTools is a collection of JavaScript utilities for JavaScript developers. All known versions include a CSS selector parser that is vulnerable to Regular Expr… |
CVE-2021-4299 | Medium | 4.3 | 2023-01-02 | A vulnerability classified as problematic was found in cronvel string-kit up to 0.12.7. This vulnerability affects the function naturalSort of the file lib/nat… |
CVE-2018-25061 | Medium | 4.3 | 2022-12-31 | A vulnerability was found in rgb2hex up to 0.1.5. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to ineff… |
CVE-2018-25049 | Low | 3.0 | 2022-12-27 | A vulnerability was found in email-existence. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The… |
CVE-2015-10005 | Low | 3.5 | 2022-12-27 | A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/html_re.js. T… |
CVE-2021-35065 | High | 7.5 | 2022-12-26 | The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression. |
CVE-2022-40897 | Medium | 5.9 | 2022-12-23 | Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom Package… |
CVE-2020-26302 | High | 7.5 | 2022-12-22 | is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of… |
CVE-2022-23517 | High | 7.5 | 2022-12-14 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer < 1.4.4 use an ineffici… |
CVE-2022-23514 | High | 7.5 | 2022-12-14 | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah < 2.19.1 contains an inefficie… |
CVE-2022-30122 | High | 7.5 | 2022-12-05 | A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack. |
CVE-2022-42124 | High | 7.5 | 2022-11-15 | ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through fix pack 18, 7.3 be… |
CVE-2022-42966 | Medium | 5.9 | 2022-11-09 | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to th… |
CVE-2022-42965 | Low | 3.7 | 2022-11-09 | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply… |
CVE-2022-42964 | Medium | 5.9 | 2022-11-09 | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input t… |
CVE-2022-37620 | High | 7.5 | 2022-10-31 | A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 because of the reCustomIgnore regular expression. |
CVE-2022-25918 | Medium | 5.3 | 2022-10-27 | The package shescape from 1.5.10 and before 1.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the escape function in index.js, due to th… |
CVE-2022-3517 | High | 7.5 | 2022-10-17 | A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with… |
CVE-2022-2908 | Medium | 4.3 | 2022-10-17 | A potential DoS vulnerability was discovered in Gitlab CE/EE versions starting from 10.7 before 15.1.5, all versions starting from 15.2 before 15.2.3, all vers… |
CVE-2022-42969 | Medium | 5.3 | 2022-10-16 | The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository w… |
CVE-2022-41323 | High | 7.5 | 2022-10-16 | In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale… |
CVE-2022-37603 | High | 7.5 | 2022-10-14 | A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url varia… |
CVE-2022-37599 | High | 7.5 | 2022-10-11 | A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourceP… |
CVE-2022-34402 | Medium | 6.8 | 2022-10-10 | Dell Wyse ThinOS 2205 contains a Regular Expression Denial of Service Vulnerability in UI. An admin privilege attacker could potentially exploit this vulnerabi… |
CVE-2022-39280 | Medium | 5.9 | 2022-10-06 | dparse is a parser for Python dependency files. dparse in versions before 0.5.2 contain a regular expression that is vulnerable to a Regular Expression Denial… |
CVE-2022-34428 | Medium | 5.0 | 2022-09-30 | Dell Hybrid Client prior to version 1.8 contains a Regular Expression Denial of Service Vulnerability in the UI. An adversary with WMS group admin access could… |
CVE-2022-24373 | Medium | 5.3 | 2022-09-30 | The package react-native-reanimated before 3.0.0-rc.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper usage of regular expressio… |
CVE-2022-21222 | Medium | 5.3 | 2022-09-30 | The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr… |
CVE-2022-37259 | High | 7.5 | 2022-09-20 | A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the string variable in babel.js. |
CVE-2022-37260 | High | 7.5 | 2022-09-15 | A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the input variable in main.js. |
CVE-2022-37262 | High | 7.5 | 2022-09-15 | A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the source and sourceWithComments variable in main.js. |
CVE-2022-40023 | High | 7.5 | 2022-09-07 | Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and lingu… |
CVE-2022-36064 | Medium | 5.9 | 2022-09-06 | Shescape is a shell escape package for JavaScript. An Inefficient Regular Expression Complexity vulnerability impacts users that use Shescape to escape argumen… |
CVE-2022-29158 | High | 7.5 | 2022-09-02 | Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthentica… |
CVE-2022-25887 | Medium | 5.3 | 2022-08-30 | The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement log… |
CVE-2022-36034 | High | 7.5 | 2022-08-29 | nitrado.js is a type safe wrapper for the Nitrado API. Possible ReDoS with lib input of `{{` and with many repetitions of `{{|`. This issue has been patched in… |
CVE-2021-43309 | Medium | 5.9 | 2022-08-24 | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary… |
CVE-2022-1930 | Medium | 5.9 | 2022-08-22 | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the eth-account PyPI package, when an attacker is able to supply arbitrary inpu… |
CVE-2022-35923 | High | 7.5 | 2022-08-02 | v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the `lowercase()` and… |
CVE-2022-2596 | Medium | 5.9 | 2022-08-01 | Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10. |
CVE-2022-34749 | High | 7.5 | 2022-07-25 | In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge c… |
CVE-2022-25858 | Medium | 5.3 | 2022-07-15 | The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular e… |
CVE-2022-31147 | High | 7.5 | 2022-07-14 | The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular… |
CVE-2022-31781 | High | 7.5 | 2022-07-13 | Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Conten… |
CVE-2022-31129 | High | 7.5 | 2022-07-06 | moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient p… |
CVE-2022-25758 | Medium | 5.3 | 2022-07-01 | All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of in… |
CVE-2022-1954 | Medium | 4.3 | 2022-07-01 | A Regular Expression Denial of Service vulnerability in GitLab CE/EE affecting all versions from 1.0.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior t… |
CVE-2022-31110 | Medium | 5.3 | 2022-06-29 | RSSHub is an open source, extensible RSS feed generator. In commits prior to 5c4177441417 passing some special values to the `filter` and `filterout` parameter… |
CVE-2021-40901 | High | 7.5 | 2022-06-27 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scniro-validator v1.0.1 when validating crafted invalid emails. |
CVE-2021-40900 | High | 7.5 | 2022-06-27 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in regexfn v1.0.5 when validating crafted invalid emails. |
CVE-2021-40899 | High | 7.5 | 2022-06-27 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in repo-git-downloader v0.1.1 when downloading crafted invalid git repositories. |