{"id":"GHSA-c2g3-c4gc-w5wg","title":"ReDoS in DotVVM routing","summary":"ReDoS in DotVVM routing","severity":"high","cwe":["CWE-1333"],"vendor":"DotVVM","product":"DotVVM","affected":["DotVVM < 4.2.11","DotVVM > 4.3.0-preview01-final, < 4.3.15","DotVVM >= 5.0.0-preview01-final, < 5.0.0-preview09-final"],"patched":["DotVVM 4.2.11","DotVVM 4.3.15","DotVVM 5.0.0-preview09-final"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-c2g3-c4gc-w5wg","references":[{"url":"https://github.com/riganti/dotvvm/security/advisories/GHSA-c2g3-c4gc-w5wg"},{"url":"https://www.dotvvm.com/docs/4.0/pages/concepts/routing/parameters#route-constraints"},{"url":"https://github.com/advisories/GHSA-c2g3-c4gc-w5wg"}],"tags":["ghsa","nuget"],"ingestedAt":"2026-06-22T15:52:21.102Z","ecosystem":"nuget","slug":"GHSA-c2g3-c4gc-w5wg","body":"## Overview\n\n### Impact\n\nThis impacts users which use multiple unconstrained route parameters not separated by a `/`. For instance, the following code is vulnerable:\n```\nvar route = new DotvvmRoute(\"edit/{a}-{b}-{c}/done\", null, \"testpage\", null, null, configuration);\n\nvar adversarialInput = \"edit/\" + new string('-', 32000);\nroute.IsMatch(adversarialInput, out _);\n```\n\n### Patches\n\nDotVVM versions 4.3.15, 4.2.11 and 5.0.0-preview09 apply a 1 second timeout to route regex operations. When it is triggered, DotVVM permanently switches to using the .NET non-backtracking regex engine for this route.\nIf non-backtracking is not supported by target runtime (< .NET 8.0), DotVVM returns HTTP 503 when the 1 second timeout is reached.\n\n### Workarounds\n\nAvoid multiple unconstrained route parameters in one section not separated by a `/`.\nSee  for documentation of route parameter constraints.\nEven with the patched version we recommend doing this both as security hardening and to avoid ambiguity.\n\nFor instance, when we change the route URL to `\"edit/{a:alpha}-{b:alpha}-{c}/done\"`, the problem disappears.\nIf all available constraints are too restrictive, we can still use `{a:regex([^-]*)}` to forbid the `-`, which is enough to remove the mabiguity\n\n## Affected packages\n\n- `DotVVM < 4.2.11`\n- `DotVVM > 4.3.0-preview01-final, < 4.3.15`\n- `DotVVM >= 5.0.0-preview01-final, < 5.0.0-preview09-final`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `DotVVM 4.2.11`\n- `DotVVM 4.3.15`\n- `DotVVM 5.0.0-preview09-final`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}