CWE-1333: Inefficient Regular Expression Complexity

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Consequences

• Availability: DoS: Resource Consumption (CPU)

How to prevent it

• Architecture and Design: Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
• System Configuration: Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
• Implementation: Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
• Implementation: Limit the length of the input that the regular expression will process.

Recent advisories

• GHSA-7wch-p9px-956x — Forge: Regular expression denial of service in PEM decoding (pem.decode)
• GHSA-xcq7-p3pf-p88h — OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api
• GHSA-xgh8-jp6q-p5x8 — Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
• GHSA-rxp7-6hxx-x8q5 — ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
• GHSA-r925-mgvr-h9cc — Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
• GHSA-4ffr-jq9g-5ffx — Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service
• GHSA-m64x-33q8-m5h7 — GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines
• GHSA-2g7p-5934-q4w7 — Payload: ReDoS in Multipart Content-Type Validation
• GHSA-fwh9-qg68-vxp4 — Ghost: Regular Expression Denial of Service in Content Import
• GHSA-9m4w-fmjw-fvjq — Ghost: Regular Expression Denial of Service in External Media Inliner
• GHSA-c475-qrg2-pj4r — basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
• GHSA-jwrc-g2q2-pq5p — PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.
• GHSA-mghh-pgcx-3jjj — Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
• GHSA-c29m-xwm3-cm6r — Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
• GHSA-v53p-9fqp-m79j — Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service

All advisories for CWE-1333