CWE-185: Incorrect Regular Expression
Class
The product specifies a regular expression in a way that causes data to be improperly matched or compared.
When the regular expression is used in protection mechanisms such as filtering or validation, this may allow an attacker to bypass the intended restrictions on the incoming data.
Consequences
- Other: Unexpected State, Varies by Context
- Access Control: Bypass Protection Mechanism
How to prevent it
- Implementation: Regular expressions can become error prone when defining a complex language even for those experienced in writing grammars. Determine if several smaller regular expressions simplify one large regular expression. Also, subject the regular expression to thorough testing techniques such as equivalence partitioning, boundary value analysis, and robustness. After testing and a reasonable confidence level is achieved, a regular expression may not be foolproof. If an exploit is allowed to slip through, then record the exploit and refactor the regular expression.
Recent advisories
- GHSA-xrhx-7g5j-rcj5 — Hono: IP Restriction bypasses static deny rules for non-canonical IPv6
- GHSA-72xp-p242-47p9 — Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
- GHSA-jccr-rrw2-vc8h — OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure
- GHSA-573f-x89g-hqp9 — Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation
- GHSA-m7jm-9gc2-mpf2 — fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
- GHSA-r354-f388-2fhh — Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing
- GHSA-cwfw-4gq5-mrqx — Regular Expression Denial of Service (ReDoS) in braces
- GHSA-r28v-mw67-m5p9 — Django denial-of-service possibility in urlize and urlizetrunc template filters
- GHSA-2f9x-5v75-3qv4 — Django Denial-of-service possibility in truncatechars_html and truncatewords_html template filters
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor