CVE-2026-57577 describes an inefficient regular expression complexity vulnerability (CWE-1333) in the DotVVM framework's routing component. Specifically, in versions before 4.2.11, 4.3.15, and 5.0.0-preview09-final, routes containing multiple unconstrained parameters within a single path segment can cause excessive backtracking in the DotvvmRoute.IsMatch method. This happens when a remote attacker supplies a long near-match path, leading to performance issues due to the lack of a matching timeout in DotvvmRouteParser.RouteRegex. The patched versions mitigate this by retrying with the .NET non-backtracking regex engine or returning an HTTP 503 error after a one-second timeout in DotvvmRoutingMiddleware.

The vulnerability can cause excessive CPU consumption and potential denial of service by exploiting the inefficient regular expression matching in the routing logic. This can degrade application performance or make the service unavailable temporarily when processing crafted HTTP requests with specific route patterns.

This vulnerability is fixed in DotVVM versions 4.2.11, 4.3.15, and 5.0.0-preview09-final. Users should upgrade to these or later versions to remediate the issue. The patched runtimes use a non-backtracking regex engine or enforce a one-second timeout with an HTTP 503 response to prevent excessive backtracking. No additional mitigation is required if these versions are in use.