CWE-185 · Incorrect Regular Expression
39 CVEs classified under CWE-185 (Incorrect Regular Expression). Browse by severity and year.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52289 | Critical | 9.8 | 2024-11-21 | authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx comparison. When no Redirect URIs are con… |
CVE-2019-12798 | Critical | 9.8 | 2019-06-13 | An issue was discovered in Artifex MuJS 1.0.5. regcompx in regexp.c does not restrict regular expression program size, leading to an overflow of the parsed syn… |
CVE-2015-8389 | Critical | 9.8 | 2015-12-02 | PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote attackers to cause a denial of service (infinite recursion) o… |
CVE-2026-25896 | Critical | 9.3 | 2026-02-20 | fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to b… |
CVE-2026-4296 | High | 8.8 | 2026-04-21 | An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. An a… |
CVE-2020-3408 | High | 8.6 | 2020-09-24 | A vulnerability in the Split DNS feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected d… |
CVE-2024-2223 | High | 8.1 | 2024-04-09 | An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigur… |
CVE-2018-17984 | High | 7.8 | 2018-10-04 | An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code execution. This is exploit… |
CVE-2026-33418 | High | 7.5 | 2026-03-24 | DiceBear is an avatar library for designers and developers. Prior to version 9.4.2, the `ensureSize()` function in `@dicebear/converter` used a regex-based app… |
CVE-2025-54365 | High | 7.5 | 2025-07-23 | fastapi-guard is a security library for FastAPI that provides middleware to control IPs, log requests, detect penetration attempts and more. In version 3.0.1… |
CVE-2025-20139 | High | 7.5 | 2025-04-02 | A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of servic… |
CVE-2019-14993 | High | 7.5 | 2019-08-13 | Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService… |
CVE-2018-20801 | High | 7.5 | 2019-03-14 | In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service atta… |
CVE-2018-11615 | High | 7.5 | 2018-08-30 | This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required to exploit this vulne… |
CVE-2018-3737 | High | 7.5 | 2018-06-07 | sshpk is vulnerable to ReDoS when parsing crafted invalid public keys. |
CVE-2018-7158 | High | 7.5 | 2018-05-17 | The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced… |
CVE-2026-48147 | Medium | 6.5 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.35.4, the buildMatcherRegex() / matches() functions in packages/backend-core/src/middleware/matchers.t… |
CVE-2026-25542 | Medium | 6.5 | 2026-04-21 | Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.43.0 and prior to versions 1.0.2, 1.3.4, 1.6.2… |
CVE-2026-25479 | Medium | 6.5 | 2026-02-09 | Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to 2.20.0, in litestar.middleware.allowed_hosts, allowlist entries are compiled in… |
CVE-2020-7929 | Medium | 6.5 | 2021-03-01 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This issue affects Mong… |