CWE-625Permissive Regular Expression

Abstraction: Base · CVEs in our corpus: 13

The product uses a regular expression that does not sufficiently restrict the set of allowed values.

This effectively causes the regexp to accept substrings that match the pattern, which produces a partial comparison to the target. In some cases, this can lead to other weaknesses. Common errors include:

Last updated: 20 August 2026 13:14 UTC

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.PS-06
SI-10 Information Input Validation

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2026-32973`	7.3	9.8	0.0041	2026-03-29
`CVE-2018-8926`	6.9	8.8	0.0171	2018-06-08
`CVE-2026-64940`	6.5	8.6	0.0040	2026-08-10
`CVE-2026-40110`	5.5	7.3	0.0034	2026-05-05
`CVE-2026-23651`	5.2	6.7	0.0059	2026-03-05
`CVE-2020-8910`	5.1	6.5	0.0054	2020-03-26
`CVE-2026-19278`	5.1	6.8	0.0021	2026-08-10
`CVE-2026-37737`	4.9	6.5	0.0016	2026-06-05
`CVE-2023-6544`	4.6	5.4	0.0107	2024-04-25
`CVE-2026-34830`	4.5	5.9	0.0021	2026-04-02
`CVE-2026-34763`	4.3	5.3	0.0024	2026-04-02
`CVE-2026-73845`	4.3	5.3	0.0022	2026-08-14
`CVE-2026-44587`	3.6	4.7	0.0022	2026-06-17