Excessive Regular Expression Backtracking in DotVVM Framework
CVE-2026-57577
What is CVE-2026-57577?
DotVVM, an open-source MVVM framework for web applications, has a vulnerability that can lead to excessive regular-expression backtracking during route matching. This issue arises when a route contains multiple unconstrained parameters within a single path segment. If a remote requester sends a long near-match path, it can result in performance degradation due to a lack of matching timeout in the DotvvmRouteParser.RouteRegex. The vulnerability has been addressed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final, with patched runtimes employing the .NET non-backtracking engine to improve matching performance and return HTTP 503 errors after a one-second timeout for unsupported runtimes.
Affected Version(s)
dotvvm < 4.2.11 < 4.2.11
dotvvm >= 4.3.0, < 4.3.15 < 4.3.0, 4.3.15
dotvvm >= 5.0.0-preview01, < 5.0.0-preview09-final < 5.0.0-preview01, 5.0.0-preview09-final