이름: Overly Restrictive Regular Expression

A regular expression is overly restrictive in a way that does not match all intended values.

일반 정보

취약점 도입 방식

Implementation

적용 가능한 플랫폼

언어

클래스: Not Language-Specific (Undetermined)

일반적인 결과

범위	영향	가능성
Access Control	Bypass Protection Mechanism, Varies by Context 참고: An overly restrictive regexp misses some potentially security-relevant values, leading to either false positives or false negatives, depending on how the regexp is being used within the code.

관찰된 예시

참고 자료	설명
CVE-2005-1604	MIE. ".php.ns" bypasses ".php$" regexp but is still parsed as PHP by Apache. (manipulates an equivalence property under Apache)

잠재적 완화 방법

Phases : Implementation
Regular expressions can become error prone when defining a complex language even for those experienced in writing grammars. Determine if several smaller regular expressions simplify one large regular expression. Also, subject your regular expression to thorough testing techniques such as equivalence partitioning, boundary value analysis, and robustness. After testing and a reasonable confidence level is achieved, a regular expression may not be foolproof. If an exploit is allowed to slip through, then record the exploit and refactor your regular expression.

취약점 매핑 메모

근거 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
댓글 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

메모

Can overlap allowlist/denylist errors (CWE-183/CWE-184)

제출

이름	조직	날짜	출시일	Version
PLOVER		2006-07-19 +00:00	2006-07-19 +00:00	Draft 3

수정 사항

이름	조직	날짜	댓글
Eric Dalci	Cigital	2008-07-01 +00:00	updated Potential_Mitigations, Time_of_Introduction
CWE Content Team	MITRE	2008-09-08 +00:00	updated Relationships, Relationship_Notes, Taxonomy_Mappings
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated Relationships
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships
CWE Content Team	MITRE	2017-11-08 +00:00	updated Applicable_Platforms
CWE Content Team	MITRE	2019-01-03 +00:00	updated Description
CWE Content Team	MITRE	2020-02-24 +00:00	updated Description, Relationships
CWE Content Team	MITRE	2020-06-25 +00:00	updated Relationship_Notes
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-12-11 +00:00	updated Weakness_Ordinalities
CWE Content Team	MITRE	2026-04-30 +00:00	updated Potential_Mitigations
CWE Content Team	MITRE	2026-10-28 +00:00	updated Common_Consequences, Demonstrative_Examples, Description

CWE-186 상세 정보

CWE-186