Riganti DotVVM up to 4.2.10/4.3.14 Routing Middleware DotvvmRoute.IsMatch incorrect regex

Summaryinfo

A vulnerability labeled as problematic has been found in Riganti DotVVM up to 4.2.10/4.3.14. Affected is the function DotvvmRoute.IsMatch of the component Routing Middleware. The manipulation results in incorrect regex. This vulnerability is cataloged as CVE-2026-57577. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Riganti DotVVM up to 4.2.10/4.3.14. Affected is the function DotvvmRoute.IsMatch of the component Routing Middleware. The manipulation with an unknown input leads to a incorrect regex vulnerability. CWE is classifying the issue as CWE-185. The product specifies a regular expression in a way that causes data to be improperly matched or compared. This is going to have an impact on availability. CVE summarizes:

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-57577 since 06/24/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

Upgrading to version 4.2.11, 4.3.15 or 5.0.0-preview09-final eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Riganti

Name

• DotVVM

Version

• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3
• 4.2.4
• 4.2.5
• 4.2.6
• 4.2.7
• 4.2.8
• 4.2.9
• 4.2.10
• 4.3.0
• 4.3.1
• 4.3.2
• 4.3.3
• 4.3.4
• 4.3.5
• 4.3.6
• 4.3.7
• 4.3.8
• 4.3.9
• 4.3.10
• 4.3.11
• 4.3.12
• 4.3.13
• 4.3.14

Website

• Product: https://github.com/riganti/dotvvm/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion