CWE-1333
AllowedInefficient Regular Expression Complexity
Abstraction: Base · Status: Draft
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
724 vulnerabilities reference this CWE, most recent first.
GHSA-XRRM-R8X3-WH4P
Vulnerability from github – Published: 2025-01-30 18:32 – Updated: 2025-01-30 18:32In versions 3.1.0 and lower of the Splunk Supporting Add-on for Active Directory, also known as SA-ldapsearch, a vulnerable regular expression pattern could lead to a Regular Expression Denial of Service (ReDoS) attack.
{
"affected": [],
"aliases": [
"CVE-2025-0367"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-30T17:15:18Z",
"severity": "MODERATE"
},
"details": "In versions 3.1.0 and lower of the Splunk Supporting Add-on for Active Directory, also known as SA-ldapsearch, a vulnerable regular expression pattern could lead to a Regular Expression Denial of Service (ReDoS) attack.",
"id": "GHSA-xrrm-r8x3-wh4p",
"modified": "2025-01-30T18:32:08Z",
"published": "2025-01-30T18:32:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0367"
},
{
"type": "WEB",
"url": "https://advisory.splunk.com/advisories/SVD-2025-0103"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XRX9-GJ26-5WX9
Vulnerability from github – Published: 2022-10-07 07:33 – Updated: 2022-10-07 07:33Impact
Inefficient regular expression complexity of lowercase() and uppercase() regex could lead to a denial of service attack. With a formed payload 'a' + 'a'.repeat(i) + 'A', only 32 characters payload could take 29443 ms time execution when testing lowercase(). The same issue happens with uppercase().
Patches
v1.5.1
References
huntr.dev report Regular Expression Denial of Service (ReDoS) and Catastrophic Backtracking
For more information
If you have any questions or comments about this advisory: * Open an issue in v8n issues list * Email us at brunodev02221@gmail.com
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "v8n"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-35923"
],
"database_specific": {
"cwe_ids": [
"CWE-1333",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2022-10-07T07:33:44Z",
"nvd_published_at": "2022-08-02T20:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\nInefficient regular expression complexity of `lowercase()` and `uppercase()` regex could lead to a denial of service attack. With a formed payload `\u0027a\u0027 + \u0027a\u0027.repeat(i) + \u0027A\u0027`, only 32 characters payload could take 29443 ms time execution when testing `lowercase()`. The same issue happens with `uppercase()`.\n\n### Patches\nv1.5.1\n\n### References\n[huntr.dev report](https://huntr.dev/bounties/2d92f644-593b-43b4-bfd1-c8042ac60609)\n[_Regular Expression Denial of Service (ReDoS) and Catastrophic Backtracking_](https://snyk.io/blog/redos-and-catastrophic-backtracking/)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [v8n issues list](https://github.com/imbrn/v8n)\n* Email us at [brunodev02221@gmail.com](mailto:brunodev02221@gmail.com)\n",
"id": "GHSA-xrx9-gj26-5wx9",
"modified": "2022-10-07T07:33:44Z",
"published": "2022-10-07T07:33:44Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/imbrn/v8n/security/advisories/GHSA-xrx9-gj26-5wx9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-35923"
},
{
"type": "WEB",
"url": "https://github.com/imbrn/v8n/commit/92393862156fad190c05ec3f6e2bc73308dcd2f9"
},
{
"type": "PACKAGE",
"url": "https://github.com/imbrn/v8n"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/2d92f644-593b-43b4-bfd1-c8042ac60609"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "v8n vulnerable to Inefficient Regular Expression Complexity"
}
GHSA-XX4C-JJ58-R7X6
Vulnerability from github – Published: 2021-11-19 20:14 – Updated: 2022-07-12 00:11Impact
Versions of validator prior to 13.7.0 are affected by an inefficient Regular Expression complexity when using the rtrim and trim sanitizers.
Patches
The problem has been patched in validator 13.7.0
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "validator"
},
"ranges": [
{
"events": [
{
"introduced": "11.1.0"
},
{
"fixed": "13.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2021-11-08T21:27:48Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Impact\nVersions of `validator` prior to 13.7.0 are affected by an inefficient Regular Expression complexity when using the `rtrim` and `trim` sanitizers.\n\n### Patches\nThe problem has been patched in validator 13.7.0",
"id": "GHSA-xx4c-jj58-r7x6",
"modified": "2022-07-12T00:11:53Z",
"published": "2021-11-19T20:14:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/validatorjs/validator.js/security/advisories/GHSA-xx4c-jj58-r7x6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3765"
},
{
"type": "WEB",
"url": "https://github.com/validatorjs/validator.js/issues/1599"
},
{
"type": "WEB",
"url": "https://github.com/validatorjs/validator.js/pull/1738"
},
{
"type": "PACKAGE",
"url": "https://github.com/validatorjs/validator.js"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/c37e975c-21a3-4c5f-9b57-04d63b28cfc9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "Inefficient Regular Expression Complexity in Validator.js"
}
GHSA-XX4V-PRFH-6CGC
Vulnerability from github – Published: 2025-02-14 17:58 – Updated: 2025-02-14 23:07Summary
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the processing of HTTP request headers. By sending an authorization header containing an excessively long sequence of spaces followed by a newline and "@", an attacker can exploit inefficient regular expression processing, leading to excessive resource consumption. This can significantly degrade server performance or cause a denial-of-service (DoS) condition, impacting availability.
Details
The issue occurs at line 52 of iterator.ts in the @octokit/request-error repository.
The vulnerability is caused by the use of an inefficient regular expression in the handling of the authorization header within the request processing logic:
authorization: options.request.headers.authorization.replace(
/ .*$/,
" [REDACTED]"
)
The regular expression / .*$/ matches a space followed by any number of characters until the end of the line. This pattern is vulnerable to Regular Expression Denial of Service (ReDoS) when processing specially crafted input. Specifically, an attacker can send an authorization header containing a long sequence of spaces followed by a newline and "@", such as:
headers: {
authorization: "" + " ".repeat(100000) + "\n@",
}
Due to the way JavaScript's regular expression engine backtracks while attempting to match the space followed by arbitrary characters, this input can cause excessive CPU usage, significantly slowing down or even freezing the server. This leads to a denial-of-service condition, impacting availability.
PoC
The gist of PoC.js 1. run npm i @octokit/request-error 2. run 'node poc.js' result: 3. then the program will stuck forever with high CPU usage
import { RequestError } from "@octokit/request-error";
const error = new RequestError("Oops", 500, {
request: {
method: "POST",
url: "https://api.github.com/foo",
body: {
bar: "baz",
},
headers: {
authorization: ""+" ".repeat(100000)+"\n@",
},
},
response: {
status: 500,
url: "https://api.github.com/foo",
headers: {
"x-github-request-id": "1:2:3:4",
},
data: {
foo: "bar",
},
},
});
Impact
Vulnerability Type & Impact:
This is a Regular Expression Denial of Service (ReDoS) vulnerability, which occurs due to an inefficient regular expression (/ .*$/) used to sanitize the authorization header. An attacker can craft a malicious input that triggers excessive backtracking in the regex engine, leading to high CPU consumption and potential denial-of-service (DoS).
Who is Impacted?
- Projects or services using this code to process HTTP headers are vulnerable.
- Applications that rely on user-supplied
authorizationheaders are at risk, especially those processing a large volume of authentication requests. - Multi-tenant or API-driven platforms could experience degraded performance or service outages if exploited at scale.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@octokit/request-error"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "5.1.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@octokit/request-error"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.1.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-25289"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2025-02-14T17:58:54Z",
"nvd_published_at": "2025-02-14T20:15:35Z",
"severity": "MODERATE"
},
"details": "### Summary\nA Regular Expression Denial of Service (ReDoS) vulnerability exists in the processing of HTTP request headers. By sending an authorization header containing an excessively long sequence of spaces followed by a newline and \"@\", an attacker can exploit inefficient regular expression processing, leading to excessive resource consumption. This can significantly degrade server performance or cause a denial-of-service (DoS) condition, impacting availability.\n### Details\nThe issue occurs at [line 52](https://github.com/octokit/request-error.js/blob/main/src/index.ts) of iterator.ts in the @octokit/request-error repository.\nThe vulnerability is caused by the use of an inefficient regular expression in the handling of the `authorization` header within the request processing logic:\n```js\nauthorization: options.request.headers.authorization.replace(\n / .*$/, \n \" [REDACTED]\"\n)\n```\nThe regular expression `/ .*$/` matches a space followed by any number of characters until the end of the line. This pattern is vulnerable to Regular Expression Denial of Service (ReDoS) when processing specially crafted input. Specifically, an attacker can send an `authorization` header containing a long sequence of spaces followed by a newline and \"@\", such as:\n```js\nheaders: {\n authorization: \"\" + \" \".repeat(100000) + \"\\n@\",\n}\n```\nDue to the way JavaScript\u0027s regular expression engine backtracks while attempting to match the space followed by arbitrary characters, this input can cause excessive CPU usage, significantly slowing down or even freezing the server. This leads to a denial-of-service condition, impacting availability.\n### PoC\n[The gist of PoC.js](https://gist.github.com/ShiyuBanzhou/e1203ad22701fd043b8501eb37676a0d)\n1. run npm i @octokit/request-error\n2. run \u0027node poc.js\u0027\nresult:\n3. then the program will stuck forever with high CPU usage\n```js\nimport { RequestError } from \"@octokit/request-error\";\n\nconst error = new RequestError(\"Oops\", 500, {\n request: {\n method: \"POST\",\n url: \"https://api.github.com/foo\",\n body: {\n bar: \"baz\",\n },\n headers: {\n authorization: \"\"+\" \".repeat(100000)+\"\\n@\",\n },\n },\n response: {\n status: 500,\n url: \"https://api.github.com/foo\",\n headers: {\n \"x-github-request-id\": \"1:2:3:4\",\n },\n data: {\n foo: \"bar\",\n },\n },\n});\n```\n\n### Impact\n#### Vulnerability Type \u0026 Impact:\nThis is a `Regular Expression Denial of Service (ReDoS) vulnerability`, which occurs due to an inefficient regular expression (`/ .*$/`) used to sanitize the `authorization` header. An attacker can craft a malicious input that triggers excessive backtracking in the regex engine, leading to high CPU consumption and potential denial-of-service (DoS).\n#### Who is Impacted?\n* Projects or services using this code to process HTTP headers are vulnerable.\n* Applications that rely on user-supplied `authorization` headers are at risk, especially those processing a large volume of authentication requests.\n* Multi-tenant or API-driven platforms could experience degraded performance or service outages if exploited at scale.",
"id": "GHSA-xx4v-prfh-6cgc",
"modified": "2025-02-14T23:07:29Z",
"published": "2025-02-14T17:58:54Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/octokit/request-error.js/security/advisories/GHSA-xx4v-prfh-6cgc"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25289"
},
{
"type": "WEB",
"url": "https://github.com/octokit/request-error.js/commit/d558320874a4bc8d356babf1079e6f0056a59b9e"
},
{
"type": "PACKAGE",
"url": "https://github.com/octokit/request-error.js"
},
{
"type": "WEB",
"url": "https://github.com/octokit/request-error.js/blob/main/src/index.ts"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking"
}
Mitigation
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
Mitigation
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Mitigation
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
Mitigation
Limit the length of the input that the regular expression will process.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.