GHSA-C2G3-C4GC-W5WG

ReDoS in DotVVM routing

Workarounds

Avoid multiple unconstrained route parameters in one section not separated by a /.
See for documentation of route parameter constraints.
Even with the patched version we recommend doing this both as security hardening and to avoid ambiguity.

For instance, when we change the route URL to "edit/{a:alpha}-{b:alpha}-{c}/done", the problem disappears.
If all available constraints are too restrictive, we can still use {a:regex([^-]*)} to forbid the -, which is enough to remove the mabiguity

This impacts users which use multiple unconstrained route parameters not separated by a /. For instance, the following code is vulnerable:

var route = new DotvvmRoute("edit/{a}-{b}-{c}/done", null, "testpage", null, null, configuration);

var adversarialInput = "edit/" + new string('-', 32000);
route.IsMatch(adversarialInput, out _);

A regular expression with worst-case exponential or polynomial matching time is applied to untrusted input, causing excessive CPU use. Typical impact: denial of service when input is crafted to trigger backtracking.

Kodem intelligence

Already deployed Kodem?

DotVVM versions 4.3.15, 4.2.11 and 5.0.0-preview09 apply a 1 second timeout to route regex operations. When it is triggered, DotVVM permanently switches to using the .NET non-backtracking regex engine for this route.
If non-backtracking is not supported by target runtime (< .NET 8.0), DotVVM returns HTTP 503 when the 1 second timeout is reached.

1. What is GHSA-C2G3-C4GC-W5WG? GHSA-C2G3-C4GC-W5WG is a high-severity inefficient regular expression (ReDoS) vulnerability in DotVVM (nuget), affecting versions < 4.2.11. It is fixed in 4.2.11, 4.3.15, 5.0.0-preview09-final. A regular expression with worst-case exponential or polynomial matching time is applied to untrusted input, causing excessive CPU use.
2. Which versions of DotVVM are affected by GHSA-C2G3-C4GC-W5WG? DotVVM (nuget) versions < 4.2.11 is affected.
3. Is there a fix for GHSA-C2G3-C4GC-W5WG? Yes. GHSA-C2G3-C4GC-W5WG is fixed in 4.2.11, 4.3.15, 5.0.0-preview09-final. Upgrade to this version or later.
4. Is GHSA-C2G3-C4GC-W5WG exploitable, and should I be worried? Whether GHSA-C2G3-C4GC-W5WG is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether GHSA-C2G3-C4GC-W5WG is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix GHSA-C2G3-C4GC-W5WG?
   • Upgrade DotVVM to 4.2.11 or later
   • Upgrade DotVVM to 4.3.15 or later
   • Upgrade DotVVM to 5.0.0-preview09-final or later

Other vulnerabilities in DotVVM