PT-2026-28656

🗓️ 01 Jan 2026 00:00:00Reported by Positive TechnologiesType

Path-to-regexp before 0.1.13: three or more params in a segment cause backtracking; upgrade or apply regex workaround.

Reporter	Title	Published	Views	Family All 46
IBM Security Bulletins	Security Bulletin: There is a vulnerability in path-to-regexp-0.1.12.tgz used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-4867)	4 May 202614:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses path-to-regexp-0.1.12.tgz which is vulnerable to CVE-2026-4867	29 May 202607:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	19 May 202605:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates	7 May 202613:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs.	3 Jun 202607:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Edge Application Manager	23 Apr 202619:33	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in path-to-regexp	28 May 202613:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Remediator is affected by mutiple vulnerabilities	27 May 202615:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in path-to-regexp-0.1.12.tgz	1 Jun 202617:14	–	ibm
IBM Security Bulletins	Security Bulletin: DevOps Test Performance contains a vulnerability related to use of the path-to-regexp package	21 Apr 202617:05	–	ibm

Source	Link
blakeembrey	www.blakeembrey.com/posts/2024-09-web-redos
twitter	www.twitter.com/kom_256/status/2037198740713316696
github	www.github.com/advisories/GHSA-9wv6-86v2-598j
osv	www.osv.dev/vulnerability/DEBIAN-CVE-2026-4867
osv	www.osv.dev/vulnerability/GHSA-37ch-88jc-xwx2
security-tracker	www.security-tracker.debian.org/tracker/CVE-2026-4867
cna	www.cna.openjsf.org/security-advisories.html
github	www.github.com/pillarjs/path-to-regexp/security/advisories/GHSA-37ch-88jc-xwx2
github	www.github.com/pillarjs/path-to-regexp
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-4867

29 Mar 2026 00:00Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

EPSS0.00018

SSVC