CVE-2026-57577

DotVVM, an open-source MVVM framework for ASP.NET web applications, is vulnerable to a regular expression denial-of-service (ReDoS, CWE-1333) in DotvvmRoute.IsMatch. If an application defines a route with multiple unconstrained parameters in a single path segment, a remote unauthenticated attacker can send a request with a long 'near-match' URL path, triggering catastrophic regex backtracking because DotvvmRouteParser.RouteRegex had no matching timeout. The attacker gains the ability to exhaust CPU and make the application unresponsive (availability-only impact; CVSS 4.0 score 8.2). All DotVVM applications using vulnerable versions (before 4.2.11, 4.3.15, and 5.0.0-preview09-final) that declare such route patterns are affected. No public proof of concept or known in-the-wild exploitation exists at this time.

What to do: Upgrade to DotVVM 4.2.11, 4.3.15, or 5.0.0-preview09-final (or later), which adds a one-second regex timeout and retries with the .NET non-backtracking engine. If upgrading immediately is not possible, audit route definitions for multiple unconstrained parameters in a single path segment (e.g., "{a}/{b}"-style multi-parameter segments) and add route constraints to them. Note that on runtimes without non-backtracking regex support the patched middleware returns HTTP 503 after the timeout, which preserves availability but can still be flooded, so consider rate-limiting or URL-length limits at the reverse proxy/WAF as defense in depth.