CVE-2026-57577

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.

• CWE-1333

• https://github.com/riganti/dotvvm/commit/1635245b5eaf9ccf8e3536b9d8b1941819526585
• https://github.com/riganti/dotvvm/commit/4fc26a8591c76fb92ed701352c2a84120cf926c5
• https://github.com/riganti/dotvvm/commit/5728ab80fff9af883b44d11c118d2e8a8991dcd4
• https://github.com/riganti/dotvvm/releases/tag/v4.3.15
• https://github.com/riganti/dotvvm/releases/tag/v5.0.0-preview09
• https://github.com/riganti/dotvvm/security/advisories/GHSA-c2g3-c4gc-w5wg

Published

Sep 14, 2026

Last Modified

Sep 14, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-57571Crawl4AI is an open-source LLM-friendly web crawler and scra…9.6
• CVE-2026-57572Crawl4AI is an open-source LLM-friendly web crawler and scra…10
• CVE-2026-57573Crawl4AI is an open-source LLM-friendly web crawler and scra…8.6
• CVE-2026-57574Misskey is an open source, federated social media platform. …7.4
• CVE-2026-57575Misskey is an open source, federated social media platform. …6.9
• CVE-2026-57576plone.app.dexterity is a content-type system for the Plone c…6.5
• CVE-2026-57578DotVVM is an open source MVVM framework for web applications…9.2
• CVE-2026-57579Alchemy is an open source content management system engine w…7.5
• CVE-2026-5758JavaScript is vulnerable to prototype pollution in Mafintosh…6.5
• CVE-2026-57580authentik is an open-source identity provider. Prior to 2026…9.4
• CVE-2026-57581DotVVM is an open source MVVM framework for web applications…5.3
• CVE-2026-57583OpenZeppelin Contracts Wizard is a web application to intera…3.3