CVE-2026-57577
Received Received - Intake

Regular Expression DoS in DotVVM Framework

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-57577
EUVD
EUVD-2026-77699

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
dotvvm dotvvm to 4.2.11 (exc)
dotvvm dotvvm to 4.3.15 (exc)
dotvvm dotvvm to 5.0.0-preview09-final (exc)
riganti dotvvm 4.2.11
riganti dotvvm 4.3.15
riganti dotvvm 5.0.0-preview09-final
riganti dotvvm to 5.0.0-preview09-final (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects DotVVM, an open-source MVVM framework for web applications. It involves excessive regular-expression backtracking in the DotvvmRoute.IsMatch function when a route contains multiple unconstrained parameters in one path segment. Attackers can exploit this by sending long near-match paths, causing the server to consume excessive resources.

Detection Guidance

This vulnerability can be detected by monitoring for excessive regular-expression backtracking in DotvvmRoute.IsMatch. Check for long near-match paths causing HTTP 503 errors or timeouts in DotvvmRoutingMiddleware. Review server logs for routes with multiple unconstrained parameters in one path segment.

Impact Analysis

This vulnerability can lead to denial-of-service (DoS) attacks. Attackers may send specially crafted requests to cause the server to hang or crash, disrupting service availability. Systems without the patch may return HTTP 503 errors after a one-second timeout.

Compliance Impact

This vulnerability primarily impacts system availability due to excessive CPU usage from ReDOS attacks, which could lead to service disruptions. While not directly violating GDPR or HIPAA, such disruptions may affect data processing integrity and availability requirements under these regulations. GDPR requires ensuring data availability and security, while HIPAA mandates safeguards for system availability. Unpatched systems could fail to meet these compliance aspects.

Mitigation Strategies

Upgrade to patched versions: 4.2.11, 4.3.15, or 5.0.0-preview09-final. If upgrading is not possible, implement rate limiting or request size restrictions to prevent excessive backtracking. Configure timeouts in DotvvmRoutingMiddleware to mitigate impact.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57577. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart