CVE-2026-57577

DotVVM: ReDOS in routing

Published Sep 14, 2026 CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Description

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.

Analysis

Technical impact

DotVVM’s routing parsing can trigger catastrophic regular‑expression backtracking when a URL contains many unconstrained parameters in a single path segment. A remote attacker can supply a long, near‑matching path that causes the .NET regex engine to consume excessive CPU time, potentially exhausting server resources and causing the application to become unresponsive. The vulnerability is classified as CWE‑1333, a regular expression denial of service flaw.

Affected Systems

The affected product is the open‑source DotVVM framework from riganti. Versions earlier than 4.2.11, 4.3.15, and 5.0.0‑preview09‑final are susceptible. The issue is fixed in those releases by adding a timeout and, where supported, using the .NET non‑backtracking regex engine, which limits the attack surface.

Risk and Exploitability

The flaw has a CVSS score of 8.2, indicating a high likelihood of successful exploitation. EPSS score is < 1%, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers can exploit it remotely from the public internet by crafting URLs that trigger regex evaluation without needing any authentication or special privileges. The available mitigation, a timeout or engine switch, reduces the risk by preventing prolonged backtracking, but the vulnerability remains severe until a patch is applied.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

riganti

dotvvm

affected

Version	Status	Constraints
`< 4.2.11`	affected	—
`>= 4.3.0, < 4.3.15`	affected	—
`>= 5.0.0-preview01, < 5.0.0-preview09-final`	affected	—

No data.

Vendor Product Versions

Riganti

Dotvvm

Version	Status	Scheme	Platform
`[0,4.2.11)`	affected	semver	—
`[4.3.0,4.3.15)`	affected	semver	—
`[5.0.0-preview01,5.0.0-preview09-final)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade DotVVM to version 4.2.11, 4.3.15, or 5.0.0‑preview09‑final, which implement a one‑second timeout and use the non‑backtracking .NET regex engine.
If an upgrade is not immediately possible, configure the web server or reverse proxy to reject request paths longer than a reasonable limit (e.g., 4–5 KB) before the request reaches DotVVM, thereby preventing excessive regex processing.
Implement explicit route constraints or simplify complex route patterns so that each path segment contains bounds or length limits, reducing the chance of catastrophic backtracking even if the underlying regex engine is not upgraded.

Generated by OpenCVE AI on September 20, 2026 at 23:06 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.577% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/riganti/dotvvm/commit/1635245b5eaf9ccf8e3536b9d8b1941819526585
https://github.com/riganti/dotvvm/commit/4fc26a8591c76fb92ed701352c2a84120cf926c5
https://github.com/riganti/dotvvm/commit/5728ab80fff9af883b44d11c118d2e8a8991dcd4
https://github.com/riganti/dotvvm/releases/tag/v4.3.15
https://github.com/riganti/dotvvm/releases/tag/v5.0.0-preview09
https://github.com/riganti/dotvvm/security/advisories/GHSA-c2g3-c4gc-w5wg

History

Sep 17, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Riganti Riganti dotvvm
Vendors & Products		Riganti Riganti dotvvm

Sep 14, 2026 9:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.
Title		DotVVM: ReDOS in routing
Weaknesses		CWE-1333
References		https://github.com/riganti/dotvvm/commit/1635245b5eaf9ccf8e3536b9d8b1941819526585 https://github.com/riganti/dotvvm/commit/4fc26a8591c76fb92ed701352c2a84120cf926c5 https://github.com/riganti/dotvvm/commit/5728ab80fff9af883b44d11c118d2e8a8991dcd4 https://github.com/riganti/dotvvm/releases/tag/v4.3.15 https://github.com/riganti/dotvvm/releases/tag/v5.0.0-preview09 https://github.com/riganti/dotvvm/security/advisories/GHSA-c2g3-c4gc-w5wg
Metrics		cvssV4_0 `{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`