{"id":"CVE-2026-57577","summary":"DotVVM: ReDOS in routing","details":"DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.","aliases":["GHSA-c2g3-c4gc-w5wg"],"modified":"2026-09-16T03:46:53.588648888Z","published":"2026-09-14T17:37:54.739Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57577.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"fixed":"4.2.11"}]}],"cna_assigner":"GitHub_M","cwe_ids":["CWE-1333"]},"references":[{"type":"WEB","url":"https://github.com/riganti/dotvvm/releases/tag/v4.3.15"},{"type":"WEB","url":"https://github.com/riganti/dotvvm/releases/tag/v5.0.0-preview09"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57577.json"},{"type":"ADVISORY","url":"https://github.com/riganti/dotvvm/security/advisories/GHSA-c2g3-c4gc-w5wg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57577"},{"type":"FIX","url":"https://github.com/riganti/dotvvm/commit/1635245b5eaf9ccf8e3536b9d8b1941819526585"},{"type":"FIX","url":"https://github.com/riganti/dotvvm/commit/4fc26a8591c76fb92ed701352c2a84120cf926c5"},{"type":"FIX","url":"https://github.com/riganti/dotvvm/commit/5728ab80fff9af883b44d11c118d2e8a8991dcd4"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/riganti/dotvvm","events":[{"introduced":"b6cc7e864bd3f870a6cc9df612edc1531a68c929"},{"introduced":"0e0c11a5a985d65f6309fb8c6f5d473adf997342"},{"fixed":"9f770c7621e641f5d000b7a777295bf68a77dd13"},{"fixed":"6324d80d588f1578aeefa5bcc2ef6e753c826968"},{"fixed":"1635245b5eaf9ccf8e3536b9d8b1941819526585"},{"fixed":"4fc26a8591c76fb92ed701352c2a84120cf926c5"},{"fixed":"5728ab80fff9af883b44d11c118d2e8a8991dcd4"}],"database_specific":{"extracted_events":[{"introduced":"4.3.0"},{"fixed":"4.3.15"},{"introduced":"5.0.0-preview01"},{"fixed":"5.0.0-preview09-final"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v4.3.14","v4.3.13","v4.3.12","v5.0.0-preview08","v4.3.11","v5.0.0-preview07","v4.3.9","v5.0.0-preview06","v5.0.0-preview05","v5.0.0-preview04","v4.3.8","v5.0.0-preview03","v4.3.7","v5.0.0-preview02","v5.0.0-preview01","v4.3.6","v4.3.5","v4.3.4","v4.3.3","v4.3.2","v4.3.1","v4.3.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57577.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}