CVE-2026-57577: Riganti Dotvvm

High severity, CVSS 8.2. EPSS: 0.6% chance of exploitation in the next 30 days.

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.

Affected products

• Riganti Dotvvm: before 4.2.11 (fixed in 4.2.11); from 4.3.0, before 4.3.15 (fixed in 4.3.15); from 5.0.0-preview01, before 5.0.0-preview09-final (fixed in 5.0.0-preview09-final)

Published 2026-09-14. Last modified 2026-09-30.