CWE-777

Regular Expression without Anchors

VariantIncompleteLikelihood: Medium

Description

The product uses a regular expression to perform neutralization, but the regular expression is not anchored and may allow malicious or malformed data to slip through.

When performing tasks such as validating against a set of allowed inputs (allowlist), data is examined and possibly modified to ensure that it is well-formed and adheres to a list of safe values. If the regular expression is not anchored, malicious or malformed data may be included before or after any string matching the regular expression. The type of malicious data that is allowed will depend on the context of the application and which anchors are omitted from the regular expression.

Hierarchy (View 1000)

Parents

CWE-625

Children

none

CVEs mapped to this weakness (5)

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2026-22068	Apache Traffic Server	Hig	0.53	8.2	0.00	Jul 29, 2026	Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
CVE-2026-39087	Binwiederhier Ntfy	Med	0.42	6.4	0.00	Apr 23, 2026	ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.
CVE-2026-40110	Jupyter Jupyter Server	Hig	0.40	7.3	0.00	May 5, 2026	Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the…
CVE-2024-1899	Showdownjs Showdown	Med	0.35	5.3	0.01	Feb 26, 2024	An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions.
CVE-2026-56021	Webmin Webmin	Med	0.27	5.3	0.00	Jun 18, 2026	Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.

CVE-2026-22068HigJul 29, 2026
Apache
Traffic Server
risk 0.53cvss 8.2epss 0.00
Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
CVE-2026-39087MedApr 23, 2026
Binwiederhier
Ntfy
risk 0.42cvss 6.4epss 0.00
ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push endpoint URLs.
CVE-2026-40110HigMay 5, 2026
Jupyter
Jupyter Server
risk 0.40cvss 7.3epss 0.00
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat configuration value. Because re.match() only anchors at the start of the…
CVE-2024-1899MedFeb 26, 2024
Showdownjs
Showdown
risk 0.35cvss 5.3epss 0.01
An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions.
CVE-2026-56021MedJun 18, 2026
Webmin
Webmin
risk 0.27cvss 5.3epss 0.00
Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.