What CVEs are caused by CWE-1333?

451 recorded CVEs are attributed to CWE-1333, including CVE-2026-82617, CVE-2026-52778, CVE-2025-62484.

What are the consequences of CWE-1333?

Exploiting CWE-1333 can lead to: DoS: Resource Consumption (CPU).

Is CWE-1333 actively exploited?

451 recorded CVEs are caused by CWE-1333; none are currently in CISA's KEV catalog of actively exploited flaws.

RadicalNotion.AI

Log in Create an account

Base weakness

Draft

CWE-1333: Inefficient Regular Expression Complexity

Also known as: ReDoS, Regular Expression Denial of Service, Catastrophic backtracking

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Last updated May 1, 2026

451

Recorded CVEs

With this primary weakness

0

KEVs

In the CISA KEV catalog

High

Likelihood of exploit

Per MITRE

Base

Abstraction

MITRE classification

Overview

CWE-1333 (Inefficient Regular Expression Complexity) is a base-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.

Background

Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match.

Real-world CVEs

451 recorded CVEs are caused by CWE-1333 (Inefficient Regular Expression Complexity). The highest-severity and most recent are shown first. 133 new CWE-1333 CVEs have been recorded so far in 2026 (81 in 2025).

CVE-2025-62484

Zoom Workplace Clients - Inefficient Regular Expression Complexity

Critical · CVSS 9.8 · EPSS 24th

2025-11-13

CVE-2023-29486

Critical · CVSS 9.8 · EPSS 63th

2023-12-21

CVE-2026-25547

Uncontrolled Resource Consumption in @isaacs/brace-expansion

Critical · CVSS 9.2 · EPSS 41th

2026-02-04

CVE-2025-25200

Koa has Inefficient Regular Expression Complexity

Critical · CVSS 9.2 · EPSS 57th

2025-02-12

CVE-2023-29487

Critical · CVSS 9.1 · EPSS 50th

2023-12-21

CVE-2022-34749

Mistune vulnerable to catastrophic backtracking

High · CVSS 8.8 · EPSS 76th

2022-07-25

CVE-2026-108082

Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

High · CVSS 8.7

2026-10-15

CVE-2026-110869

Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes

High · CVSS 8.7 · EPSS 22th

2026-10-14

CVE-2026-110856

GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date

High · CVSS 8.7 · EPSS 19th

2026-10-14

CVE-2026-109563

N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex

High · CVSS 8.7 · EPSS 27th

2026-10-12

Showing 12 of 451 recorded CWE-1333 CVEs. Get an alert for each new one, with AI-written analysis and fixes.

Monitor CWE-1333 vulnerabilities

Common consequences

What can happen when CWE-1333 is exploited.

DoS: Resource Consumption (CPU)

Affects: Availability

Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Implementation

How to prevent it

Practical mitigations for CWE-1333, grouped by where in the lifecycle they apply.

Architecture and Design

Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.

Effectiveness: High — This is one of the few effective solutions when using user-provided regular expressions.

System Configuration

Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.

Effectiveness: Moderate

Implementation

Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.

Effectiveness: High

Implementation

Limit the length of the input that the regular expression will process.

Effectiveness: Moderate

How to detect it

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Effectiveness: High

Code examples

MITRE examples of the weakness in code.

This example attempts to check if an input string is a "sentence" [REF-1164].

This example attempts to check if an input string is a "sentence" and is modified for Perl [REF-1164].

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2020-5243 — server allows ReDOS with crafted User-Agent strings, due to overlapping capture groups that cause excessive backtracking.
CVE-2021-21317 — npm package for user-agent parser prone to ReDoS due to overlapping capture groups
CVE-2019-16215 — Markdown parser uses inefficient regex when processing a message, allowing users to cause CPU consumption and delay preventing processing of other messages.
CVE-2019-6785 — Long string in a version control product allows DoS due to an inefficient regex.
CVE-2019-12041 — Javascript code allows ReDoS via a long string due to excessive backtracking.
CVE-2015-8315 — ReDoS when parsing time.
CVE-2015-8854 — ReDoS when parsing documents.
CVE-2017-16021 — ReDoS when validating URL.

Terminology & mappings

Alternate terms

ReDoS: ReDoS is an abbreviation of "Regular expression Denial of Service".
Regular Expression Denial of Service: While this term is attack-focused, this is commonly used to describe the weakness.
Catastrophic backtracking: This term is used to describe the behavior of the regular expression as a negative technical impact.

Attack patterns

CAPEC attack patterns that exploit this weakness.

CAPEC-492: Regular Expression Exponential Blowup

Frequently asked questions

Common questions about CWE-1333.

What is CWE-1333?: The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
What CVEs are caused by CWE-1333?: 451 recorded CVEs are attributed to CWE-1333, including CVE-2026-82617, CVE-2026-52778, CVE-2025-62484.
How do you prevent CWE-1333?: Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
How is CWE-1333 detected?: Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
What are the consequences of CWE-1333?: Exploiting CWE-1333 can lead to: DoS: Resource Consumption (CPU).
Is CWE-1333 actively exploited?: 451 recorded CVEs are caused by CWE-1333; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Track CWE-1333 CVEs

Get an alert when a new CWE-1333 CVE affects your products, with AI-written analysis and remediation steps.

Create an account See pricing

Overview

Background

Real-world CVEs

Common consequences

How it happens

When it is introduced

How to prevent it

How to detect it

Automated Static Analysis

Code examples

Illustrative examples

Related weaknesses

Parent

Terminology & mappings

Alternate terms

Attack patterns

Frequently asked questions

References

Track CWE-1333 CVEs