CVE-2026-57577: DotVVM: ReDOS in routing

Q: Which applications are exposed to this issue?

Applications using a vulnerable DotVVM version are exposed when they define a route with multiple unconstrained parameters in the same path segment. The problematic request must contain a long path that nearly matches that route.

Q: What does an attacker need to do to trigger the problem?

A remote requester needs only to send a long near-match URL path to an affected route. The route must have multiple unconstrained parameters in one path segment, which can trigger excessive regular-expression backtracking during route matching.

Q: What happens if a vulnerable runtime cannot use the .NET non-backtracking engine?

After the fix, runtimes without non-backtracking matching support return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. Patched runtimes that support it retry matching with the .NET non-backtracking engine.

Q: Which versions contain the fix?

The issue is fixed in DotVVM versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.

Published Sep 14, 2026

Updated

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.

Affected Software

2 affected components

DotVVM DotVVM>4.2.11<=4.3.15

DotVVM<4.2.11, <4.3.15, <5.0.0-preview09-final

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade DotVVM to a version that resolves this vulnerability.
Fixed in 4.2.11
Upgrade
Upgrade DotVVM to a version that resolves this vulnerability.
Fixed in 4.3.15
Upgrade
Upgrade DotVVM to a version that resolves this vulnerability.
Fixed in 5.0.0-preview09-final

Event History

Sep 14, 2026

CVE Published

via MITRE·05:37 PM

Data Sourced

via MITRE·05:37 PM

DescriptionWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using a vulnerable DotVVM version are exposed when they define a route with multiple unconstrained parameters in the same path segment. The problematic request must contain a long path that nearly matches that route.

What does an attacker need to do to trigger the problem?