Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-57577

DotVVM: ReDOS in routing

CVSS 4.0 8.2 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-57577

Published

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-57577

Published

dotvvm

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "riganti",
                    "product": "dotvvm",
                    "versions": [
                        {
                            "version": "< 4.2.11",
                            "status": "affected"
                        },
                        {
                            "version": ">= 4.3.0, < 4.3.15",
                            "status": "affected"
                        },
                        {
                            "version": ">= 5.0.0-preview01, < 5.0.0-preview09-final",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON