CVE-2026-57577: 
C# vulnerability analysis and mitigation

CVE-2026-57577 is a Regular Expression Denial of Service (ReDoS) vulnerability in the DotVVM web framework's routing engine. It was published on June 18, 2026, and affects DotVVM NuGet package versions prior to 4.2.11, versions between 4.3.0-preview01-final and 4.3.15, and versions from 5.0.0-preview01-final up to (but not including) 5.0.0-preview09-final. The vulnerability carries a CVSS v4 base score of 8.2 (High) (GitHub Advisory, DotVVM Advisory).

The root cause is CWE-1333 (Inefficient Regular Expression Complexity): DotVVM's routing engine generates regular expressions to match URL route patterns, and when multiple unconstrained route parameters appear in the same URL segment separated by non-slash delimiters (e.g., edit/{a}-{b}-{c}/done), the resulting regex exhibits exponential backtracking behavior. An unauthenticated attacker can send a crafted HTTP request with an adversarially long URL segment (e.g., edit/ followed by thousands of - characters) to trigger catastrophic backtracking in the regex engine, consuming excessive CPU cycles. No authentication or special privileges are required; the only precondition is that the target application defines at least one route with multiple unconstrained parameters in a single non-slash-delimited segment (GitHub Advisory, DotVVM Advisory).

Successful exploitation causes a high-severity availability impact on the vulnerable system, as the regex engine consumes excessive CPU cycles processing the adversarial input, potentially rendering the web application unresponsive or causing a denial of service. There is no confidentiality or integrity impact — attackers cannot read data or modify system state through this vulnerability. The impact is limited to the vulnerable DotVVM application instance; no lateral movement or data exfiltration risk has been identified (GitHub Advisory).

No public exploit code, active in-the-wild exploitation, or threat actor attribution has been reported for CVE-2026-57577 as of the advisory publication date. The vulnerability is straightforward to exploit conceptually — sending a single crafted HTTP GET request with a long adversarial URL is sufficient — but requires the target application to use a specific vulnerable route pattern. No EPSS score or CISA KEV catalog entry has been identified for this CVE (DotVVM Advisory).

1. Reconnaissance: Identify web applications built with DotVVM (NuGet package) running versions prior to 4.2.11, 4.3.15, or 5.0.0-preview09-final. Look for DotVVM-specific response headers, view-source indicators, or NuGet package manifests.
2. Identify vulnerable routes: Browse the application to discover URL patterns that contain multiple route parameters within a single path segment separated by non-slash delimiters (e.g., /edit/{a}-{b}-{c}/done).
3. Craft adversarial input: Construct a URL targeting the vulnerable route segment with a very long string of the delimiter character (e.g., edit/ followed by 32,000 or more - characters): GET /edit/----------------------------------------------------------------.../done HTTP/1.1.
4. Send the request: Submit the crafted HTTP request to the target server. The DotVVM routing engine will attempt to match the URL against the vulnerable regex, triggering catastrophic backtracking and consuming excessive CPU.
5. Achieve denial of service: Repeat requests as needed to sustain CPU exhaustion, causing the application to become unresponsive or return errors to legitimate users (GitHub Advisory, DotVVM Advisory).

• Network: Repeated HTTP requests to URL paths matching DotVVM route patterns with unusually long path segments containing repetitive delimiter characters (e.g., hundreds or thousands of - characters in a single path segment).
• Logs: Web server access logs showing requests with abnormally long URLs (e.g., >1,000 characters in a single path segment) returning HTTP 503 responses (on unpatched pre-.NET 8.0 systems) or exhibiting high latency.
• Process: Sustained high CPU utilization on the web server process (e.g., dotnet.exe or w3wp.exe) coinciding with the anomalous requests, without a corresponding increase in legitimate traffic.

Upgrade DotVVM to patched versions 4.2.11, 4.3.15, or 5.0.0-preview09-final, which apply a 1-second timeout to route regex operations and automatically switch to the .NET non-backtracking regex engine (requires .NET 8.0+); on older runtimes, the application returns HTTP 503 on timeout. As a workaround without upgrading, add constraints to route parameters to prevent ambiguous matching — for example, change {a}-{b}-{c} to {a:alpha}-{b:alpha}-{c} or use {a:regex([^-]*)} to forbid the delimiter character. Even on patched versions, applying route constraints is recommended as security hardening (DotVVM Advisory, GitHub Advisory).