CWE-1333 · Inefficient Regular Expression Complexity (page 5)
Page 5 of 5 — CVEs classified under CWE-1333, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-40898 | High | 7.5 | 2022-06-27 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in scaffold-helper v1.2.0 when copying crafted invalid files. |
CVE-2021-40897 | High | 7.5 | 2022-06-27 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in split-html-to-chars v1.0.5 when splitting crafted invalid htmls. |
CVE-2021-40896 | High | 7.5 | 2022-06-27 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in that-value v0.1.3 when validating crafted invalid emails. |
CVE-2021-40895 | High | 7.5 | 2022-06-27 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in todo-regex v0.1.1 when matching crafted invalid TODO statements. |
CVE-2021-40894 | High | 7.5 | 2022-06-24 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in underscore-99xp v1.7.2 when the deepValueSearch function is called. |
CVE-2021-40893 | High | 7.5 | 2022-06-24 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-data v0.1.1 when validating crafted invalid emails. |
CVE-2021-40892 | High | 7.5 | 2022-06-24 | A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-color v2.1.0 when handling crafted invalid rgb(a) strings. |
CVE-2021-46823 | Medium | 6.5 | 2022-06-18 | python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial… |
CVE-2021-40660 | High | 7.5 | 2022-06-14 | An issue was discovered in Delight Nashorn Sandbox 0.2.0. There is an ReDoS vulnerability that can be exploited to launching a denial of service (DoS) attack. |
CVE-2022-1929 | Medium | 5.9 | 2022-06-02 | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to… |
CVE-2021-43308 | Medium | 5.9 | 2022-06-02 | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arb… |
CVE-2021-43307 | Medium | 5.9 | 2022-06-02 | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary inpu… |
CVE-2021-43306 | Medium | 5.9 | 2022-06-02 | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary… |
CVE-2022-29169 | High | 7.5 | 2022-06-01 | BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnerable to regular expr… |
CVE-2022-21195 | Medium | 5.3 | 2022-05-20 | All versions of package url-regex are vulnerable to Regular Expression Denial of Service (ReDoS) which can cause the CPU usage to crash. |
CVE-2022-26650 | High | 7.5 | 2022-05-17 | In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both param… |
CVE-2022-1510 | Medium | 6.5 | 2022-05-11 | An issue has been discovered in GitLab affecting all versions starting from 13.9 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions sta… |
CVE-2022-29167 | High | 7.4 | 2022-05-05 | Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and re… |
CVE-2022-25844 | Medium | 5.3 | 2022-05-01 | The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assi… |
CVE-2022-24836 | High | 7.5 | 2022-04-11 | Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive back… |
CVE-2022-25598 | High | 7.5 | 2022-03-30 | Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to v… |
CVE-2022-24729 | Medium | 6.5 | 2022-03-16 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vu… |
CVE-2022-24713 | High | 7.5 | 2022-03-08 | regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks cau… |
CVE-2022-21681 | High | 7.5 | 2022-01-14 | Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against so… |
CVE-2022-21680 | High | 7.5 | 2022-01-14 | Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings… |
CVE-2022-21670 | Medium | 5.3 | 2022-01-10 | markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser signific… |
CVE-2021-3842 | High | 7.5 | 2022-01-04 | nltk is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-41817 | High | 7.5 | 2022-01-01 | Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3… |
CVE-2021-23490 | High | 7.5 | 2021-12-24 | The package parse-link-header before 2.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the checkHeader function. |
CVE-2021-45470 | High | 7.5 | 2021-12-23 | lib/DatabaseLayer.py in cve-search before 4.1.0 allows regular expression injection, which can lead to ReDoS (regular expression denial of service) or other im… |
CVE-2021-43843 | Medium | 5.3 | 2021-12-20 | jsx-slack is a package for building JSON objects for Slack block kit surfaces from JSX. The maintainers found the patch for CVE-2021-43838 in jsx-slack v4.5.1… |
CVE-2021-43838 | Medium | 5.3 | 2021-12-17 | jsx-slack is a library for building JSON objects for Slack Block Kit surfaces from JSX. In versions prior to 4.5.1 users are vulnerable to a regular expression… |
CVE-2021-39940 | Medium | 4.3 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-39933 | Medium | 4.3 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versi… |
CVE-2021-43805 | High | 7.5 | 2021-12-07 | Solidus is a free, open-source ecommerce platform built on Rails. Versions of Solidus prior to 3.1.4, 3.0.4, and 2.11.13 have a denial of service vulnerability… |
CVE-2021-3765 | High | 7.5 | 2021-11-02 | validator.js is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-41115 | Medium | 4.3 | 2021-10-07 | Zulip is an open source team chat server. In affected versions Zulip allows organization administrators on a server to configure "linkifiers" that automaticall… |
CVE-2021-23446 | High | 7.5 | 2021-09-29 | The package handsontable before 10.0.0; the package handsontable from 0 and before 10.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) in Han… |
CVE-2021-3828 | High | 7.5 | 2021-09-27 | nltk is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-3822 | High | 7.5 | 2021-09-27 | jsoneditor is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-3820 | High | 7.5 | 2021-09-27 | inflect is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-3810 | High | 7.5 | 2021-09-17 | code-server is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-3807 | High | 7.5 | 2021-09-17 | ansi-regex is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-3804 | High | 7.5 | 2021-09-17 | taro is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-3803 | High | 7.5 | 2021-09-17 | nth-check is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-3795 | High | 7.5 | 2021-09-15 | semver-regex is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-3801 | Medium | 6.5 | 2021-09-15 | prism is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-3794 | High | 7.5 | 2021-09-15 | vuelidate is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-3777 | High | 7.5 | 2021-09-15 | nodejs-tmpl is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-3749 | High | 7.5 | 2021-08-31 | axios is vulnerable to Inefficient Regular Expression Complexity |
CVE-2021-3649 | High | 7.5 | 2021-07-16 | chatwoot is vulnerable to Inefficient Regular Expression Complexity |
CVE-2020-1920 | High | 7.5 | 2021-06-01 | A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unres… |
CVE-2021-33502 | High | 7.5 | 2021-05-24 | The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it… |
CVE-2021-23364 | Medium | 5.3 | 2021-04-28 | The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries. |
CVE-2021-23382 | Medium | 5.3 | 2021-04-26 | The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-ma… |
CVE-2021-23362 | Medium | 5.3 | 2021-03-23 | The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl fun… |
CVE-2021-25292 | Medium | 6.5 | 2021-03-19 | An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic… |
CVE-2021-27291 | High | 7.5 | 2021-03-17 | In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have expo… |
CVE-2021-28092 | High | 7.5 | 2021-03-12 | The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker… |
CVE-2021-23354 | Medium | 5.3 | 2021-03-12 | The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string /\%(?:\(([\w_.]+)\)|([1-9]\d*)\$)?([0 +\-\]… |
CVE-2021-26813 | High | 7.5 | 2021-03-03 | markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can m… |
CVE-2021-21317 | Medium | 5.3 | 2021-02-16 | uap-core in an open-source npm package which contains the core of BrowserScope's original user agent string parser. In uap-core before version 0.11.0, some reg… |
CVE-2020-5243 | Medium | 5.7 | 2020-02-21 | uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression… |
CVE-2019-16215 | Medium | 6.5 | 2019-09-18 | The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into the server could s… |
CVE-2019-12041 | High | 7.5 | 2019-05-13 | lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section. |
CVE-2017-16021 | Medium | 6.5 | 2018-06-04 | uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-j… |
CVE-2015-8854 | High | 7.5 | 2017-01-23 | The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophi… |
CVE-2015-8315 | High | 7.5 | 2017-01-23 | The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression de… |