CWE-185 · Incorrect Regular Expression

41 CVEs classified under CWE-185 (Incorrect Regular Expression). Browse by severity and year.

Top CVEs for CWE-185
CVESeverityScorePublishedSummary
CVE-2024-52289Critical9.82024-11-21authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx comparison. When no Redirect URIs are con…
CVE-2019-12798Critical9.82019-06-13An issue was discovered in Artifex MuJS 1.0.5. regcompx in regexp.c does not restrict regular expression program size, leading to an overflow of the parsed syn…
CVE-2015-8389Critical9.82015-12-02PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote attackers to cause a denial of service (infinite recursion) o…
CVE-2026-25896Critical9.32026-02-20fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to b…
CVE-2026-4296High8.82026-04-21An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. An a…
CVE-2020-3408High8.62020-09-24A vulnerability in the Split DNS feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected d…
CVE-2024-2223High8.12024-04-09An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigur…
CVE-2018-17984High7.82018-10-04An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code execution. This is exploit…
CVE-2026-33418High7.52026-03-24DiceBear is an avatar library for designers and developers. Prior to version 9.4.2, the `ensureSize()` function in `@dicebear/converter` used a regex-based app…
CVE-2025-54365High7.52025-07-23fastapi-guard is a security library for FastAPI that provides middleware to control IPs, log requests, detect penetration attempts and more. In version 3.0.1…
CVE-2025-20139High7.52025-04-02A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of servic…
CVE-2019-14993High7.52019-08-13Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService…
CVE-2018-20801High7.52019-03-14In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service atta…
CVE-2018-11615High7.52018-08-30This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required to exploit this vulne…
CVE-2018-3737High7.52018-06-07sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.
CVE-2018-7158High7.52018-05-17The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced…
CVE-2026-48147Medium6.52026-05-27Budibase is an open-source low-code platform. Prior to 3.35.4, the buildMatcherRegex() / matches() functions in packages/backend-core/src/middleware/matchers.t…
CVE-2026-25542Medium6.52026-04-21Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2…
CVE-2026-25479Medium6.52026-02-09Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, in litestar.middleware.allowed_hosts, allowlist entries are compiled in…
CVE-2020-7929Medium6.52021-03-01A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This issue affects Mong…
All CVEs classified under CWE-185 — newest first (page 1 of 1)
CVESeverityScorePublishedSummary
CVE-2026-73425Low3.72026-08-12Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular express…
CVE-2026-646552026-08-06GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify  builds the certificate Subject Alternative Name matcher from th…
CVE-2026-45065Medium6.12026-07-14Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, UrlGenerator val…
CVE-2026-56021Medium5.32026-06-18Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.
CVE-2026-47674Medium5.32026-05-28Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the ip-restriction middleware (hono/ip-restriction) com…
CVE-2026-48147Medium6.52026-05-27Budibase is an open-source low-code platform. Prior to 3.35.4, the buildMatcherRegex() / matches() functions in packages/backend-core/src/middleware/matchers.t…
CVE-2026-4296High8.82026-04-21An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. An a…
CVE-2026-25542Medium6.52026-04-21Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2…
CVE-2026-39350Medium5.42026-04-15Istio is an open platform to connect, manage, and secure microservices. In versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1, the servi…
CVE-2026-33347Medium6.12026-03-24league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an a…
CVE-2026-33418High7.52026-03-24DiceBear is an avatar library for designers and developers. Prior to version 9.4.2, the `ensureSize()` function in `@dicebear/converter` used a regex-based app…
CVE-2026-27895Medium4.32026-03-18LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, the PDF…
CVE-2026-3419Medium5.32026-03-06Fastify incorrectly accepts malformed `Content-Type` headers containing trailing characters after the subtype token, in violation of RFC 9110 §8.3.1(https://ht…
CVE-2026-25896Critical9.32026-02-20fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to b…
CVE-2026-25479Medium6.52026-02-09Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, in litestar.middleware.allowed_hosts, allowlist entries are compiled in…
CVE-2026-24398Medium4.82026-01-27Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, IP Restriction Middleware in Hono is vulnerable…
CVE-2025-54365High7.52025-07-23fastapi-guard is a security library for FastAPI that provides middleware to control IPs, log requests, detect penetration attempts and more. In version 3.0.1…
CVE-2025-20139High7.52025-04-02A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of servic…
CVE-2024-52289Critical9.82024-11-21authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx comparison. When no Redirect URIs are con…
CVE-2024-6641Medium5.32024-09-18The WP Hardening – Fix Your WordPress Security plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 1.2.6. This…
CVE-2024-2223High8.12024-04-09An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigur…
CVE-2021-36093Medium5.32021-09-06It's possible to create an email which can be stuck while being processed by PostMaster filters, causing DoS. This issue affects: OTRS AG ((OTRS)) Community Ed…
CVE-2018-1109Medium5.32021-03-30A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of…
CVE-2020-7929Medium6.52021-03-01A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This issue affects Mong…
CVE-2020-3408High8.62020-09-24A vulnerability in the Split DNS feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected d…
CVE-2020-7016Medium4.82020-07-27Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An attacker can construct a URL that when viewed by a Kibana user c…
CVE-2020-11034Medium6.12020-05-05In GLPI before version 9.4.6, there is a vulnerability that allows bypassing the open redirect protection based which is based on a regexp. This is fixed in ve…
CVE-2020-1741Medium5.92020-04-24A flaw was found in openshift-ansible. OpenShift Container Platform (OCP) 3.11 is too permissive in the way it specified CORS allowed origins during installati…
CVE-2019-14993High7.52019-08-13Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService…
CVE-2019-12798Critical9.82019-06-13An issue was discovered in Artifex MuJS 1.0.5. regcompx in regexp.c does not restrict regular expression program size, leading to an overflow of the parsed syn…
CVE-2018-20801High7.52019-03-14In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service atta…
CVE-2018-20164Medium5.32019-02-13An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote…
CVE-2018-17984High7.82018-10-04An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code execution. This is exploit…
CVE-2018-11615High7.52018-08-30This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required to exploit this vulne…
CVE-2018-3738Medium5.52018-06-07protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.
CVE-2018-3737High7.52018-06-07sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.
CVE-2018-7158High7.52018-05-17The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced…
CVE-2018-7537Medium5.32018-03-09An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods we…
CVE-2018-7536Medium5.32018-03-09An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to e…
CVE-2015-8389Critical9.82015-12-02PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote attackers to cause a denial of service (infinite recursion) o…
CVE-2015-83882015-12-02PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to…