CWE-1333 · Denial of Service
Inefficient Regular Expression Complexity
546CVEs
0exploited
0with a public check
6likely (EPSS 10%+)
SortMost likely exploited
546 CVEs with CWE-1333 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-3364Inefficient Regular Expression Complexity in GitLabGitLab · GitLab · CVSS 7.5 · 2023-08-01 | 7.5 | 44% | 2023-08-01 |
| CVE-2024-8124Inefficient Regular Expression Complexity in GitLabGitLab · GitLab · CVSS 7.5 · 2024-09-12 | 7.5 | 40% | 2024-09-12 |
| CVE-2024-25126Rack ReDos in content type parsing (2nd degree polynomial)rack · rack · CVSS 5.3 · 2024-02-28 | 5.3 | 35% | 2024-02-28 |
| CVE-2024-2651Inefficient Regular Expression Complexity in GitLabGitLab · GitLab · CVSS 6.5 · 2024-05-09 | 6.5 | 33% | 2024-05-09 |
| CVE-2021-32837mechanize vulnerable to ReDoSpython-mechanize · mechanize · CVSS 7.5 · 2023-01-17 | 7.5 | 29% | 2023-01-17 |
| CVE-2024-2829Inefficient Regular Expression Complexity in GitLabGitLab · GitLab · CVSS 7.5 · 2024-04-25 | 7.5 | 26% | 2024-04-25 |
| CVE-2021-3749Inefficient Regular Expression Complexity in axios/axiosaxios · axios/axios · CVSS 7.5 · 2021-08-31 | 7.5 | 8.5% | 2021-08-31 |
| CVE-2015-8315The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReD…Vercel · Ms · CVSS 7.5 · 2017-01-23 | 7.5 | 7.0% | 2017-01-23 |
| CVE-2026-44496Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injectionaxios · axios · CVSS 7.5 · 2026-06-11 | 7.5 | 5.4% | 2026-06-11 |
| CVE-2022-25844Regular Expression Denial of Service (ReDoS)Angularjs · angular · CVSS 5.3 · 2022-05-01 | 5.3 | 4.9% | 2022-05-01 |
| CVE-2015-8854The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue…Marked Project · Marked · 2017-01-23 | – | 4.4% | 2017-01-23 |
| CVE-2021-27291In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic wor…Pygments · Pygments · 2021-03-17 | – | 3.9% | 2021-03-17 |
| CVE-2022-41323In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is…Djangoproject · Django · CVSS 7.5 · 2022-10-16 | 7.5 | 3.8% | 2022-10-16 |
| CVE-2021-23362Regular Expression Denial of Service (ReDoS)Npmjs · hosted-git-info · CVSS 5.3 · 2021-03-23 | 5.3 | 3.6% | 2021-03-23 |
| CVE-2021-3807Inefficient Regular Expression Complexity in chalk/ansi-regexchalk · chalk/ansi-regex · CVSS 7.5 · 2021-09-17 | 7.5 | 3.6% | 2021-09-17 |
| CVE-2022-24836Inefficient Regular Expression Complexity in Nokogirisparklemotion · nokogiri · CVSS 7.5 · 2022-04-11 | 7.5 | 3.5% | 2022-04-11 |
| CVE-2021-41817Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.Ruby-Lang · Date · 2022-01-01 | – | 3.5% | 2022-01-01 |
| CVE-2022-25858Regular Expression Denial of Service (ReDoS)Terser · terser · CVSS 5.3 · 2022-07-15 | 5.3 | 3.3% | 2022-07-15 |
| CVE-2022-21680Cubic catastrophic backtracking (ReDoS) in markedmarkedjs · marked · CVSS 7.5 · 2022-01-14 | 7.5 | 3.0% | 2022-01-14 |
| CVE-2023-36053In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack…Djangoproject · Django · CVSS 7.5 · 2023-07-03 | 7.5 | 3.0% | 2023-07-03 |
| CVE-2021-23446Regular Expression Denial of Service (ReDoS)Handsontable · handsontable · CVSS 7.5 · 2021-09-29 | 7.5 | 3.0% | 2021-09-29 |
| CVE-2022-21681Exponential catastrophic backtracking (ReDoS) in markedmarkedjs · marked · CVSS 7.5 · 2022-01-14 | 7.5 | 2.9% | 2022-01-14 |
| CVE-2022-37599A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in inte…Webpack.js · Loader-Utils · 2022-10-11 | – | 2.8% | 2022-10-11 |
| CVE-2022-25883Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a ra…Npmjs · semver · CVSS 5.3 · 2023-06-21 | 5.3 | 2.8% | 2023-06-21 |
| CVE-2022-37603A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateNa…Webpack.js · Loader-Utils · CVSS 7.5 · 2022-10-14 | 7.5 | 2.7% | 2022-10-14 |
| CVE-2022-26650Apache ShenYu (incubating) Regular expression denial of serviceApache Software Foundation · Apache ShenYu (incubating) · 2022-05-17 | – | 2.7% | 2022-05-17 |
| CVE-2023-28755A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase…Ruby-Lang · Uri · CVSS 5.3 · 2023-03-31 | 5.3 | 2.6% | 2023-03-31 |
| CVE-2022-40897Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is…Python · Setuptools · CVSS 5.9 · 2022-12-22 | 5.9 | 2.6% | 2022-12-22 |
| CVE-2021-23382Regular Expression Denial of Service (ReDoS)Postcss · postcss · CVSS 5.3 · 2021-04-26 | 5.3 | 2.6% | 2021-04-26 |
| CVE-2023-28756A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increas…Ruby-Lang · Ruby · 2023-03-31 | – | 2.5% | 2023-03-31 |
| CVE-2021-23364Regular Expression Denial of Service (ReDoS)Browserslist Project · browserslist · CVSS 5.3 · 2021-04-28 | 5.3 | 2.4% | 2021-04-28 |
| CVE-2022-40023Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.Sqlalchemy · Mako · 2022-09-07 | – | 2.3% | 2022-09-07 |
| CVE-2021-26813markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can make markdown2 proces…Markdown2 Project · Markdown2 · 2021-03-03 | – | 2.3% | 2021-03-03 |
| CVE-2022-31147jquery-validation ReDoS in url2 due to incomplete fix of CVE-2021-43306jquery-validation · jquery-validation · CVSS 7.5 · 2022-07-14 | 7.5 | 2.3% | 2022-07-14 |
| CVE-2021-3803Inefficient Regular Expression Complexity in fb55/nth-checkfb55 · fb55/nth-check · CVSS 7.5 · 2021-09-17 | 7.5 | 2.2% | 2021-09-17 |
| CVE-2024-6232Regular-expression DoS when parsing TarFile headersPython Software Foundation · CPython · CVSS 7.5 · 2024-09-03 | 7.5 | 2.2% | 2024-09-03 |
| CVE-2017-20165debug-js debug node.js useColors redosdebug-js · debug · CVSS 3.5 · 2023-01-09 | 3.5 | 2.2% | 2023-01-09 |
| CVE-2022-29158Regular Expression Denial of Service (ReDoS) vulnerability in Apache OFBizApache Software Foundation · Apache OFBiz · 2022-09-02 | – | 2.2% | 2022-09-02 |
| CVE-2021-23354Regular Expression Denial of Service (ReDoS)Adaltas · printf · CVSS 5.3 · 2021-03-12 | 5.3 | 2.2% | 2021-03-12 |
| CVE-2022-25758Regular Expression Denial of Service (ReDoS)Scss-Tokenizer Project · scss-tokenizer · CVSS 5.3 · 2022-07-01 | 5.3 | 2.1% | 2022-07-01 |
| CVE-2022-42969The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info dat…Pytest · Py · CVSS 5.3 · 2022-10-16 | 5.3 | 2.1% | 2022-10-16 |
| CVE-2021-28092The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker provides a maliciou…Is-Svg Project · Is-Svg · 2021-03-12 | – | 2.0% | 2021-03-12 |
| CVE-2024-26146Possible Denial of Service Vulnerability in Rack Header Parsingrack · rack · CVSS 5.3 · 2024-02-28 | 5.3 | 2.0% | 2024-02-28 |
| CVE-2022-25598Apache DolphinScheduler user registration is vulnerable to ReDoS attacksApache Software Foundation · Apache DolphinScheduler · 2022-03-30 | – | 2.0% | 2022-03-30 |
| CVE-2021-43843Insufficient patch for Regular Expression Denial of Service (ReDoS) to jsx-slack v4.5.1yhatt · jsx-slack · CVSS 5.3 · 2021-12-20 | 5.3 | 2.0% | 2021-12-20 |
| CVE-2021-46823python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service (ReDoS)…Python-Ldap · Python-Ldap · 2022-06-18 | – | 2.0% | 2022-06-18 |
| CVE-2022-31781Regular Expression Denial of Service (ReDoS) in ContentType.java. (GHSL-2022-022)Apache Software Foundation · Apache Tapestry · 2022-07-13 | – | 2.0% | 2022-07-13 |
| CVE-2022-1510An issue has been discovered in GitLab affecting all versions starting from 13.9 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 bef…GitLab · GitLab · CVSS 6.5 · 2022-05-11 | 6.5 | 2.0% | 2022-05-11 |
| CVE-2021-45470lib/DatabaseLayer.py in cve-search before 4.1.0 allows regular expression injection, which can lead to ReDoS (regular expression denial of service) or other impacts.Circl · Cve-Search · 2021-12-23 | – | 1.9% | 2021-12-23 |
| CVE-2022-21222Regular Expression Denial of Service (ReDoS)Css-What Project · css-what · CVSS 5.3 · 2022-09-30 | 5.3 | 1.9% | 2022-09-30 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.