SB2026111239 - Inefficient regular expression complexity in Matrix Javascript SDK

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026111239

SB2026111239 - Inefficient regular expression complexity in Matrix Javascript SDK

Published: November 12, 2026

Security Bulletin ID SB2026111239
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Partial DoS

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Inefficient regular expression complexity (CVE-ID: N/A)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to cause a denial of service in clients using the Matrix JavaScript SDK.

The vulnerability exists due to inefficient regular expression complexity in glob pattern evaluation when processing push rules or m.ignore.invites policy rules. A remote privileged user can include a malicious push rule glob pattern in a homeserver /sync response or, as administrator of a policy room to which the victim subscribes, specify a malicious rule pattern to trigger catastrophic regex backtracking and deny client service.


Remediation

Install update from vendor's website.

References