CWE-1333
Inefficient Regular Expression Complexity
About
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Common consequences
- Availability → DoS: Resource Consumption (CPU)
Mitigations
- Architecture and Design: Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
- System Configuration: Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
- Implementation: Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
- Implementation: Limit the length of the input that the regular expression will process.
CVEs with this weakness
Frequently asked questions
What is CWE-1333?
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential. Common consequences Availability → DoS: Resource Consumption (CPU) Mitigations Architecture and Design: Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
How likely is CWE-1333 to be exploited?
MITRE rates the likelihood of exploit for CWE-1333 as high.
How many CVEs does Rainforest track for CWE-1333?
Rainforest Labs currently tracks 1 published CVEs mapped to CWE-1333. They are listed on this page.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.