目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-1333 类漏洞列表 316

CWE-1333 类弱点 316 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-1333 属于正则表达式复杂度漏洞，指产品使用了最坏情况下计算效率低下甚至呈指数级增长的表达式。攻击者通常通过构造特定的“灾难性回溯”输入，触发正则引擎的无限循环或极高资源消耗，从而实施拒绝服务攻击。开发者应避免使用嵌套量词或重叠子模式，采用非贪婪匹配、原子组或预编译优化，并限制输入长度，以确保正则表达式的执行效率与安全性。

MITRE CWE 官方描述
CWE：CWE-1333 低效的正则表达式复杂度 (Inefficient Regular Expression Complexity) 英文：产品使用的正则表达式在最坏情况下的计算复杂度低效，且可能呈指数级增长。
常见影响 (1)
Availability DoS: Resource Consumption (CPU)
Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.
缓解措施 (4)
Architecture and Design Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
Effectiveness: High
System Configuration Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Effectiveness: Moderate
Implementation Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
Effectiveness: High
Implementation Limit the length of the input that the regular expression will process.
Effectiveness: Moderate
代码示例 (2)
This example attempts to check if an input string is a "sentence" [REF-1164].
var test_string = "Bad characters: $@#"; var bad_pattern  = /^(\w+\s?)*$/i; var result = test_string.search(bad_pattern);
Bad · JavaScript
var test_string = "Bad characters: $@#"; var good_pattern  = /^((?=(\w+))\2\s?)*$/i; var result = test_string.search(good_pattern);
Good · JavaScript
This example attempts to check if an input string is a "sentence" and is modified for Perl [REF-1164].
my $test_string = "Bad characters: \$\@\#"; my $bdrslt = $test_string; $bdrslt =~ /^(\w+\s?)*$/i;
Bad · Perl
my $test_string = "Bad characters: \$\@\#"; my $gdrslt = $test_string; $gdrslt =~ /^((?=(\w+))\2\s?)*$/i;
Good · Perl
CVE ID 标题 CVSS 风险等级 Published
CVE-2021-43805 Solidus 安全漏洞 — solidus 7.5 High 2021-12-07
CVE-2021-3765 validator.js 安全漏洞 — validatorjs/validator.js 7.5 - 2021-11-02
CVE-2021-3828 Nltk 代码问题漏洞 — nltk/nltk 7.5 - 2021-09-27
CVE-2021-3822 Josdejong Jsoneditor 资源管理错误漏洞 — josdejong/jsoneditor 7.5 - 2021-09-27
CVE-2021-3820 Inflect 安全漏洞 — pksunkara/inflect 7.5 - 2021-09-27
CVE-2021-3810 Coder code-server 安全漏洞 — cdr/code-server 7.5 - 2021-09-17
CVE-2021-3804 taro 安全漏洞 — nervjs/taro 7.5 - 2021-09-17
CVE-2021-3803 nth-check 安全漏洞 — fb55/nth-check 7.5 - 2021-09-17
CVE-2021-3807 ansi-regex 安全漏洞 — chalk/ansi-regex 7.5 - 2021-09-17
CVE-2021-3795 semver-regex 安全漏洞 — sindresorhus/semver-regex 7.5 - 2021-09-15
CVE-2021-3801 Prism 安全漏洞 — prismjs/prism 7.5 - 2021-09-15
CVE-2021-3794 Vuelidate 安全漏洞 — vuelidate/vuelidate 7.5 - 2021-09-15
CVE-2021-3777 nodejs-tmpl 安全漏洞 — daaku/nodejs-tmpl 7.5 - 2021-09-15
CVE-2021-3749 Axios 资源管理错误漏洞 — axios/axios 7.5 - 2021-08-31
CVE-2021-3649 chatwoot 安全漏洞 — chatwoot/chatwoot 7.5 - 2021-07-16
CVE-2020-1920 React Native代码问题漏洞 — react-native 7.5 - 2021-06-01

CWE-1333 是常见的弱点类别，本平台收录该类弱点关联的 316 条 CVE 漏洞。