Executive brief
DotVVM is an open source MVVM web framework used to build .NET web applications. A flaw in its routing engine allows an attacker to send specially crafted requests with long paths that cause excessive CPU consumption through regex backtracking, leading to service unavailability. Affected applications return HTTP 503 errors and become unresponsive to legitimate traffic during an attack.
Technical details
The vulnerability is a regular expression denial of service (ReDoS) in DotvvmRoute.IsMatch when processing routes containing multiple unconstrained parameters in a single path segment. DotvvmRouteParser.RouteRegex previously lacked a matching timeout. A remote attacker can send HTTP requests with long near-match paths to trigger catastrophic backtracking in the regex engine. The attack is network-accessible and requires no authentication. On patched runtimes, the code retries with the .NET non-backtracking engine; older runtimes timeout after one second in DotvvmRoutingMiddleware and return HTTP 503. The fix is available in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.
Affected products
- DotVVM DotVVM before 4.2.11, 4.3.x before 4.3.15, 5.0.0-preview before preview09-final
Timeline
- 2026-09-14: disclosed
- 2026-06-18: patched: Patches committed to main branch (versions 4.2.11, 4.3.15, 5.0.0-preview09-final)