CVE-2026-57577: DotVVM Framework DOS Vulnerability

CVE-2026-57577 Overview

CVE-2026-57577 is a Regular Expression Denial of Service (ReDoS) vulnerability in DotVVM, an open source Model-View-ViewModel (MVVM) framework for .NET web applications. The flaw affects DotvvmRoute.IsMatch when a route definition contains multiple unconstrained parameters within a single path segment. A remote attacker can supply a crafted near-match URL that triggers catastrophic backtracking in the compiled route regex, consuming CPU resources and starving the application of throughput. The issue is tracked as CWE-1333: Inefficient Regular Expression Complexity and is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.

Critical Impact
Unauthenticated remote requesters can exhaust server CPU by sending long near-match paths that trigger exponential regex backtracking in the DotVVM routing middleware.

Affected Products

DotVVM versions prior to 4.2.11
DotVVM versions prior to 4.3.15
DotVVM versions prior to 5.0.0-preview09-final

Discovery Timeline

2026-09-14 - CVE-2026-57577 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-57577

Vulnerability Analysis

DotVVM builds a route matcher by translating DotVVM route templates into a .NET Regex inside DotvvmRouteParser.RouteRegex. When a route template places two or more unconstrained parameters within one path segment, the generated pattern contains ambiguous alternations. The .NET default regex engine uses a backtracking NFA. An attacker can craft a request path that matches the ambiguous prefix but fails at the end, forcing the engine to explore an exponential number of possible parameter splits.

The original implementation did not set a MatchTimeout, allowing a single request to occupy a worker thread indefinitely. Repeated requests exhaust the ASP.NET thread pool and result in a denial of service against the entire application.

Root Cause

The root cause is inefficient regular expression complexity [CWE-1333] in the route pattern compiled by DotvvmRouteParser. The generated regex is not linear-time safe and no matching timeout was configured on routeRegex, so pathological inputs cause runaway backtracking inside DotvvmRoutingMiddleware.

Attack Vector

Exploitation requires only network access to a route registered with multiple adjacent unconstrained parameters in one segment. An unauthenticated attacker sends an HTTP request with a long, near-match URL. The routing middleware invokes routeRegex.Match(url) and the engine enters catastrophic backtracking, pinning CPU until the request is cancelled or the process is restarted.

csharp

// Patch from src/Framework/Framework/Routing/DotvvmRoute.cs
// Source: https://github.com/riganti/dotvvm/commit/5728ab80fff9af883b44d11c118d2e8a8991dcd4
if (!url.StartsWith("/"))
    url = '/' + url;

Match match;
try
{
    match = routeRegex.Match(url);
}
catch (RegexMatchTimeoutException)
#if NET7_0_OR_GREATER
    when ((routeRegex.Options & RegexOptions.NonBacktracking) == 0)
#else
    when (false)
#endif
{
    routeRegex = new Regex(
        routeRegex.ToString(),
        routeRegex.Options | RegexOptions.NonBacktracking,
        DotvvmRouteParser.RouteRegexMatchTimeout);
    return IsMatch(url, out values);
}

if (!match.Success)
{
    values = null!;
}

The patch wraps the match call in a try/catch for RegexMatchTimeoutException. On .NET 7 or greater, it rebuilds the regex with RegexOptions.NonBacktracking and retries. On older runtimes, the middleware returns HTTP 503 after the one-second timeout defined in DotvvmRoutingMiddleware.

Detection Methods for CVE-2026-57577

Indicators of Compromise

Sustained high CPU on the ASP.NET worker process without a corresponding increase in completed requests.
HTTP 503 responses emitted by DotvvmRoutingMiddleware after the one-second route match timeout on patched builds.
Access logs containing unusually long URL paths targeting DotVVM routes that declare multiple parameters in a single segment.

Detection Strategies

Enumerate registered DotVVM routes and flag any template containing two or more unconstrained parameters within the same path segment.
Instrument the routing middleware to log requests where routeRegex.Match exceeds a low millisecond threshold.
Correlate spikes in RegexMatchTimeoutException events with source IPs and request URIs at the reverse proxy.

Monitoring Recommendations

Track per-endpoint request latency and CPU-time-per-request for the DotVVM process.
Alert on repeated HTTP 503 responses tied to routing failures from a single client IP or user agent.
Ingest web server and application logs into a centralized data lake for path-length and repetition analysis across the fleet.

How to Mitigate CVE-2026-57577

Immediate Actions Required

Upgrade DotVVM to 4.2.11, 4.3.15, or 5.0.0-preview09-final or later.
Audit route definitions and refactor templates that place multiple unconstrained parameters within a single segment.
Place rate limiting and request-size limits in front of the application to blunt exploitation attempts until patching is complete.

Patch Information

The fix is delivered in the GitHub Security Advisory GHSA-c2g3-c4gc-w5wg and implemented across commits 1635245b, 4fc26a85, and 5728ab80. Fixed builds are published as DotVVM v4.3.15 and v5.0.0-preview09. Patched runtimes on .NET 7+ retry with RegexOptions.NonBacktracking; older runtimes return HTTP 503 after a one-second match timeout.

Workarounds

Rewrite vulnerable routes so each unconstrained parameter occupies its own path segment or add regex constraints that eliminate ambiguity.
Enforce a maximum URL length at the reverse proxy or WAF to reject the long near-match paths required for the attack.
Deploy request rate limiting per source IP to reduce the impact of repeated ReDoS attempts.

bash

# Update DotVVM package references to a patched version
dotnet add package DotVVM.AspNetCore --version 4.3.15
dotnet add package DotVVM.Core --version 4.3.15
dotnet restore
dotnet build -c Release