DerScanner
Home / Vulnerability Database / PHP : DOS attack via regular expressions possible
PHP

PHP : DOS attack via regular expressions possible

Classification

OWASP ASVS
Validation, Sanitization and Encoding
CWE
CWE-400

Overview

The regexp used is from an unreliable source, which can be computationally intensive for some inputs. Regular expression denial of service (ReDOS) attack is possible.

Regular expressions are widely used in applications to validate the user-supplied data. Expressions containing structures like (( )+)+ cause execution of a significant amount of iterations. By inputting a certain type of string an attacker can disrupt the application operation. All implementations of regular expressions have such vulnerabilities.

References

  1. OWASP: Regular expression Denial of Service
  2. Runaway Regular Expressions: Catastrophic Backtracking – regular-expressions.info
  3. CWE-326: Uncontrolled Resource Consumption
MEDIUM

DerScanner Severity Score

Do you want to fix PHP : DOS attack via regular expressions possible in your application?

See also

PHP

PHP : Null salt

PHP

PHP : Empty password

PHP

PHP : Empty salt