Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-57577— DotVVM: ReDOS in routing

Quick assessment

Affected
riganti dotvvm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

DotVVM 是一个用于 Web 应用的开源 MVVM 框架。在 4.2.11、4.3.15 和 5.0.0-preview09-final 之前，如果一个路由在单个路径片段中包含多个未加约束的参数，当远程请求者提供一个长的、接近匹配的路径时， 会引发正则表达式的过度回溯（excessive regular-expression backtracking）。此前， 未设置匹配超时。 补丁后的运行时使用 .NET 的非回溯引擎进行重试；而如果不支持非回溯匹配的运行时，会在 中的一秒超时后返回 HTTP 503 响应。

CVSS 8.2 · High

Affected Version Matrix 3

VendorProduct Version RangeStatus
riganti dotvvm < 4.2.11 affected
>= 4.3.0, < 4.3.15 affected
>= 5.0.0-preview01, < 5.0.0-preview09-final affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-57577

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
DotVVM: ReDOS in routing
Source: CVE Program / CVE List V5
Vulnerability Description
DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1333
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
riganti dotvvm < 4.2.11 -

II. Public POCs for CVE-2026-57577

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-57577

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-57577 (2)

Vendor Advisories for CVE-2026-57577 (1)

Vendor Pages for CVE-2026-57577 (1)

Same Patch Batch · riganti · 2026-09-14 · 3 CVEs total

CVE-2026-57578 9.2 CRITICAL DotVVM: Missing authorization in AuthorizeActionFilter
CVE-2026-57581 5.3 MEDIUM DotVVM: Unrestricted file upload

IV. Related Vulnerabilities

Same product: dotvvm
Same vendor: riganti
Same weakness: CWE-1333

V. Comments for CVE-2026-57577

No comments yet

Leave a comment