Skip to main content

Dotvvm CVE-2026-57577

| EUVDEUVD-2026-77699 HIGH
Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)
2026-09-14 GitHub_M
Denial Of Service Dotvvm
8.2
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.2 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
POC Analysis Generated
Sep 15, 2026 - 15:25 vuln.today
Source Code Evidence Fetched
Sep 15, 2026 - 11:23 vuln.today
Analysis Generated
Sep 15, 2026 - 11:23 vuln.today
Patch available
Sep 14, 2026 - 19:03 EUVD
CVE Published
Sep 14, 2026 - 17:37 cve.org
HIGH 8.2

DescriptionCVE.org

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.

AnalysisAI

A regular-expression denial-of-service (ReDoS) flaw in DotVVM's routing engine (DotvvmRoute.IsMatch / DotvvmRouteParser.RouteRegex) lets a remote requester send a long, near-matching URL path and force excessive regex backtracking, tying up a worker thread for roughly one second per request. Only applications that declare routes with multiple unconstrained parameters inside a single path segment (e.g. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Dotvvm

View all
CVE-2026-57578 CRITICAL
9.2 Sep 14

We need answer JSON only. Need synthesize. Must include all fields strings, data_quality_flags array? It says JSON array
CVE-2026-57581 MEDIUM
5.3 Sep 14

Unrestricted file upload in DotVVM before 4.2.11, 4.3.15, and 5.0.0-preview09-final lets unauthenticated remote users pu

Same weakness CWE-1333 – Inefficient Regular Expression Complexity (ReDoS)

View all
CVE-2023-29486 CRITICAL POC
9.8
CVE-2023-29487 CRITICAL POC
9.1
CVE-2026-48801 HIGH POC
8.7
CVE-2024-58340 HIGH POC
8.7
CVE-2026-0621 HIGH POC
8.7
CVE-2024-21490 HIGH POC
7.5
CVE-2022-42969 HIGH POC
7.5
CVE-2015-8315 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-57577 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy