Gold Open Source
ExplorePackagesVulnerabilitiesMCP Servers
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/CWEs/CWE-1333
Common Weakness Enumeration

CWE-1333: Inefficient Regular Expression (ReDoS)

ShareXLinkedInRedditHN

A regex with catastrophic backtracking lets small inputs consume unbounded CPU.

Abstraction
Base
OWASP Top 10
A05:2021 (#5)
Exploit Likelihood
Medium
Related CVEs
92

How to mitigate

Avoid nested quantifiers; use RE2-style linear engines for untrusted input; cap input length.

▪ References & documentation

https://cwe.mitre.org/data/definitions/1333.htmlNVD CWE listing

▪ How attackers exploit CWE-1333

MITRE ATT&CK techniques associated with this weakness class (mapped via MITRE CAPEC). A vulnerability of this type could let an adversary carry out:

T1499Endpoint Denial of Serviceimpact

Step-by-step: how CWE-1333 gets exploited

A stage-by-stage walkthrough of the attack, mapped to the real MITRE ATT&CK tactics for this weakness — what the attacker is trying to do, what's at risk (what can be stolen or damaged), and how you defend. Understanding the playbook is how you shut it down.

  1. 1
    Impactimpact

    Cause damage — destroy, encrypt, deny, or manipulate.

    At risk / what's stolen

    Availability and integrity: ransomware encryption, data wiping, or service denial.

    How you defend

    Tested offline backups, integrity checks, and rate/abuse limiting.

This is a defensive, conceptual walkthrough for education — stages reflect MITRE ATT&CK tactics associated with this weakness class, not a working exploit. Not every attack uses every stage.

▪ Related CVEs

CVE-2022-25883Medium

Security vulnerability in semver

CVE-2026-33671High

Security vulnerability in picomatch

CVE-2026-27904High

Security vulnerability in minimatch

CVE-2026-26996High

Security vulnerability in minimatch

CVE-2022-25883Medium

Security vulnerability in semver

CVE-2022-25883Medium

Security vulnerability in semver

CVE-2022-25883Medium

Security vulnerability in semver

CVE-2023-26115Medium

Security vulnerability in word-wrap

CVE-2021-41817High

Security vulnerability in ruby

CVE-2023-28756Medium

Security vulnerability in ruby

CVE-2026-27904High

Security vulnerability in minimatch

CVE-2026-26996High

Security vulnerability in minimatch

CVE-2026-48801High

Security vulnerability in linkify-it

CVE-2026-2327Medium

Security vulnerability in markdown-it

CVE-2026-48801High

Security vulnerability in linkify-it

CVE-2026-27904High

Security vulnerability in minimatch

CVE-2026-26996High

Security vulnerability in minimatch

CVE-2026-26996High

Security vulnerability in minimatch

CVE-2026-26996High

Security vulnerability in minimatch

CVE-2026-27904High

Security vulnerability in minimatch

CVE-2026-33671High

Security vulnerability in picomatch

CVE-2026-27904High

Security vulnerability in minimatch

CVE-2021-28092High

Security vulnerability in is-svg

CVE-2022-25758High

Security vulnerability in scss-tokenizer

CVE-2026-27904High

Security vulnerability in minimatch

CVE-2022-37599High

Security vulnerability in loader-utils

CVE-2021-23362Medium

Security vulnerability in hosted-git-info

CVE-2022-25858Medium

Security vulnerability in terser

CVE-2021-23382Medium

Security vulnerability in postcss

CVE-2022-37603High

Security vulnerability in loader-utils

CVE-2026-26996High

Security vulnerability in minimatch

CVE-2021-23382Medium

Security vulnerability in postcss

CVE-2022-25883Medium

Security vulnerability in semver

CVE-2022-25883Medium

Security vulnerability in semver

CVE-2021-3749High

Security vulnerability in axios

CVE-2024-49761High

Security vulnerability in rexml

CVE-2026-27904High

Security vulnerability in minimatch

CVE-2026-26996High

Security vulnerability in minimatch

CVE-2024-25126Medium

Security vulnerability in rack

CVE-2024-26146Medium

Security vulnerability in rack

CVE-2026-35611High

Security vulnerability in addressable

CVE-2026-102270High

Security vulnerability in pyjwt

CVE-2026-102270Medium

Security vulnerability in pyjwt

CVE-2026-102270Medium

Security vulnerability in pyjwt

CVE-2026-87819High

Security vulnerability in gitpython

CVE-2026-48801High

Security vulnerability in linkify-it

CVE-2026-26996High

Security vulnerability in minimatch

CVE-2021-23382Medium

Security vulnerability in postcss

CVE-2026-27904High

Security vulnerability in minimatch

CVE-2020-26311High

Security vulnerability in useragent

CVE-2020-26304High

Security vulnerability in foundation

CVE-2026-87819High

Security vulnerability in gitpython

CVE-2026-33671High

Security vulnerability in picomatch

CVE-2026-26996High

Security vulnerability in minimatch

CVE-2026-27904High

Security vulnerability in minimatch

CVE-2026-23956High

Security vulnerability in seroval

CVE-2022-25883High

Security vulnerability in semver

CVE-2022-25883High

Security vulnerability in semver

CVE-2022-25883High

Security vulnerability in semver

CVE-2022-25883High

Security vulnerability in semver

CVE-2026-8159High

Security vulnerability in multiparty

CVE-2015-8315High

Security vulnerability in ms

CVE-2026-26996High

Security vulnerability in minimatch

CVE-2026-27904High

Security vulnerability in minimatch

CVE-2026-26996High

Security vulnerability in minimatch

CVE-2026-27904High

Security vulnerability in minimatch

CVE-2026-26996High

Security vulnerability in minimatch

CVE-2026-27904High

Security vulnerability in minimatch

CVE-2022-37599High

Security vulnerability in loader-utils

CVE-2022-37603High

Security vulnerability in loader-utils

CVE-2025-25200High

Security vulnerability in koa

CVE-2025-25200High

Security vulnerability in koa

CVE-2021-23362Medium

Security vulnerability in hosted-git-info

CVE-2026-30837High

Security vulnerability in elysia

CVE-2021-3807High

Security vulnerability in ansi-regex

CVE-2021-3807High

Security vulnerability in ansi-regex

CVE-2022-25883High

Security vulnerability in semver

CVE-2026-26996High

Security vulnerability in minimatch

CVE-2026-27904High

Security vulnerability in minimatch

GHSA-jwrc-g2q2-pq5pMedium

Security vulnerability in pyjwt

GHSA-3ppc-4f35-3m26High

CVE-2026-26996

GHSA-23c5-xmqv-rm74High

CVE-2026-27904

GHSA-g5vv-9gxw-82hxHigh

Security vulnerability in gitpython

GHSA-23c5-xmqv-rm74High

Security vulnerability in minimatch

GHSA-3ppc-4f35-3m26High

Security vulnerability in minimatch

CVE-2021-23364Medium

Security vulnerability in browserslist

CVE-2021-3803High

Security vulnerability in nth-check

CVE-2021-23362Medium

Security vulnerability in hosted-git-info

CVE-2022-37599High

Security vulnerability in loader-utils

CVE-2022-37603High

Security vulnerability in loader-utils

CVE-2017-20165High

Security vulnerability in debug

CVE-2026-79770High

Security vulnerability in nokogiri