CVE-2026-57577

UNKNOWN 0.0

DotVVM: ReDOS in routing

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.

CWE	CWE-1333
Vendor	riganti
Product	dotvvm
Published	Sep 14, 2026
Last Updated	Sep 14, 2026

Stay Ahead of the Next One

Get instant alerts for riganti dotvvm

Be the first to know when new unknown vulnerabilities affecting riganti dotvvm are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

riganti / dotvvm

< 4.2.11 >= 4.3.0, < 4.3.15 >= 5.0.0-preview01, < 5.0.0-preview09-final

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/riganti/dotvvm/security/advisories/GHSA-c2g3-c4gc-w5wg github.com: https://github.com/riganti/dotvvm/commit/1635245b5eaf9ccf8e3536b9d8b1941819526585 github.com: https://github.com/riganti/dotvvm/commit/4fc26a8591c76fb92ed701352c2a84120cf926c5 github.com: https://github.com/riganti/dotvvm/commit/5728ab80fff9af883b44d11c118d2e8a8991dcd4 github.com: https://github.com/riganti/dotvvm/releases/tag/v4.3.15 github.com: https://github.com/riganti/dotvvm/releases/tag/v5.0.0-preview09