CVE-2026-57577
- Source
- https://cve.org/CVERecord?id=CVE-2026-57577
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57577.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-57577
- Aliases
-
- GHSA-c2g3-c4gc-w5wg
- Published
- 2026-09-14T17:37:54Z
- Modified
- 2026-09-16T03:46:53Z
- Severity
-
- 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- DotVVM: ReDOS in routing
- Details
-
DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-1333" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57577.json", "unresolved_ranges": [ { "extracted_events": [ { "fixed": "4.2.11" } ], "source": "AFFECTED_FIELD" } ] }- References
-
- https://github.com/riganti/dotvvm/releases/tag/v4.3.15
- https://github.com/riganti/dotvvm/releases/tag/v5.0.0-preview09
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57577.json
- https://github.com/riganti/dotvvm/security/advisories/GHSA-c2g3-c4gc-w5wg
- https://nvd.nist.gov/vuln/detail/CVE-2026-57577
- https://github.com/riganti/dotvvm/commit/1635245b5eaf9ccf8e3536b9d8b1941819526585
- https://github.com/riganti/dotvvm/commit/4fc26a8591c76fb92ed701352c2a84120cf926c5
- https://github.com/riganti/dotvvm/commit/5728ab80fff9af883b44d11c118d2e8a8991dcd4
Affected packages
Git / github.com/riganti/dotvvm
Affected ranges
- Type
- GIT
- Repo
- https://github.com/riganti/dotvvm
- Events
-
IntroducedIntroducedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "4.3.0" }, { "fixed": "4.3.15" }, { "introduced": "5.0.0-preview01" }, { "fixed": "5.0.0-preview09-final" } ], "source": [ "AFFECTED_FIELD", "REFERENCES" ] }