Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Untrusted input passed to language.ParseAcceptLanguage or go-i18n NewLocalizer without validating length or separator counts ('-' and '_') can trigger quadratic-time parsing and cause denial of service (CVE-2026-79658).
Splitting strings using a regex with whitespace tolerance like `/\s*,\s*/` can cause Regular Expression Denial of Service (ReDoS) when processing long inputs without commas. Use literal string splitting with `.split(',')` followed by `.map(s => s.trim())` instead.
Regular expression compiled from dynamic input is executed without enforcing a timeout. Untrusted regex patterns can cause catastrophic backtracking and Denial of Service (ReDoS). Pass `timeout=...` to regex execution methods or use a safe execution wrapper.
Overlapping nested quantifiers in regular expression can lead to ReDoS (CWE-1333).
PythonCVE-2026-59925Regular expressions using negative lookaheads for markdown text markers (e.g., `~~(?!~)`) can bypass intermediate boundaries in heavily chained contiguous token sequences. In a recursive descent parser, this collapse forces the engine to parse large blocks recursively, leading to O(N^2) CPU exhaustion DoS. Use iterative string search (`str.find`) with manual
Matching dollar-quoted strings or dynamic delimiters using a lazy dot-all regex with a backreference (e.g. `\$...[\s\S]*?\1`) leads to quadratic time complexity (ReDoS) when applied over unmatched delimiters. Use a linear, single-pass delimiter-resolution algorithm instead.
Found a regular expression pattern using unbounded quantifiers (`+` or `*`) in a way that can lead to Regular Expression Denial of Service (ReDoS). An attacker can provide crafted input to cause catastrophic backtracking (O(n^2) complexity).
Overlapping regex quantifiers can lead to catastrophic backtracking (ReDoS) when processing malicious input without a closing '>'.
A recursive function performs pattern matching branching with 'or' and without memoization. This can lead to evaluating overlapping subproblems multiple times, resulting in an exponential Time Complexity (Denial of Service) when evaluating strings containing many wildcards. Use dynamic programming with a memoization dictionary or a `@functools.cache` decorat
Repeatedly applying regular expression substitution in a fixpoint loop until the string stops changing can cause quadratic O(N^2) running time on nested inputs, leading to CPU exhaustion Denial of Service (DoS). Replace the loop with a single-pass or stack-based parser.
Repeatedly applying regular expression substitution in a `while` loop until no changes occur exhibits quadratic O(N^2) time complexity on deeply nested inputs, potentially causing a denial of service (DoS). Use a single-pass or stack-based parsing approach instead.
Compiling grammar regexes without a timeout can lead to ReDoS or Uncontrolled Resource Consumption via exponential state-space expansion during DFA construction. Wrap calls using `compile_regex_with_timeout` or another timeout guard.
Translating wildcard patterns into regular expressions by mapping '*' to '.*?' or '.*' can lead to catastrophic backtracking (ReDoS) when evaluated against untrusted or complex inputs. Use non-regex string scanning (such as str.find/split) or a linear-time pattern matcher instead.
Overlapping digit matchers (`\d+\.\?\d*` or `[\d]+\.\?[\d]*`) inside regular expressions allow ambiguous partitioning of integer inputs. When evaluated inside repeated groups, this leads to catastrophic exponential backtracking (ReDoS) on non-matching strings. Replace optional dot and trailing digits with explicit non-capturing groups such as `(?:\.\d*)?`.
JSONata expressions are vulnerable to ReDoS via the $toMillis function when parsing fractional seconds without length boundary constraints.
Use of the Parse Server ClientSDK module (or an equivalent regex with two adjacent unbounded "+"-quantified character classes and no anchors, e.g. /([-a-zA-Z]+)([0-9\.]+)/) is susceptible to polynomial / catastrophic backtracking (ReDoS, CWE-1333). When the regex is applied to attacker-controlled input such as the X-Parse-Client-Version header or a _ClientVe
User input was passed directly to the standard Python `re` module. The standard `re` module is vulnerable to Regular Expression Denial of Service (ReDoS) when processing untrusted complex patterns, as it lacks a timeout mechanism. To fix this, consider using the third-party `regex` module which allows setting execution timeouts to protect against catastrophi
regexp2.Compile result is used without assigning a MatchTimeout. The github.com/dlclark/regexp2 engine supports backtracking and defaults MatchTimeout to math.MaxInt64 (no timeout). When the pattern source is attacker-controlled (e.g. parsed from a request header or form field), a crafted regex with nested quantifiers can cause exponential backtracking and h
Overly broad, optional, or overlapping regex groups such as `(.*)?$` can cause catastrophic backtracking (ReDoS) leading to DoS. Use more specific character classes instead.
Algorithmic complexity vulnerability (ReDoS) due to lookahead-heavy regex repeatedly evaluated via `gsub!`. The `NumberToDelimitedConverter` uses `gsub!` with a lookahead-based regular expression (`delimiter_pattern`) across the entire string without constraints, causing O(N^2) complexity on long digit strings. Ensure string manipulations on large untrusted
A denial of service vulnerability exists due to an unbounded loop over unvalidated PDF sizes, or ReDoS in regex parsing xref/trailer data with overlapping whitespaces.
Trimming whitespace with `\s*` combined with anchors (`^` or `$`) can lead to catastrophic backtracking (ReDoS) when processing strings with large blocks of whitespace. Use `\s+` instead of `\s*` to prevent quadratic evaluation time.
The regular expression `/\*+$/` is vulnerable to Regular Expression Denial of Service (ReDoS). When evaluated against a long string of asterisks that does not end at the string boundary, the regular expression engine engages in catastrophic backtracking (O(N^2) complexity in many JavaScript engines). Use a manual backward iteration loop with `charCodeAt` or
Splitting an untrusted string with the regular expression `/\s*,\s*/` can lead to Regular Expression Denial of Service (ReDoS) or excessive CPU consumption. An attacker providing a maliciously crafted string (e.g., many consecutive spaces without commas) can trigger worst-case execution time in the regex engine. Instead, split by the comma character literall
