CVE-2026-83617

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QNameexact expression produced by reg in lib/grammar.js, which inherits the multiline...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Improper Input Validation.

Summary fast-xml-parser is used by IBM Storage Fusion Data Foundation, which could cause Improper Input Validation. CVE-2026-25896. Vulnerability Details CVEID:CVE-2026-25896 DESCRIPTION: fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C...

CVE-2026-83609 xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg builder in lib/grammar.js compiles the anchored QNameexact validator with the multiline flag, so ^ and $ validate only one line instead of the complete...

CVE-2026-83609 xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg builder in lib/grammar.js compiles the anchored QNameexact validator with the multiline flag, so ^ and $ validate only one line instead of the complete...

CVE-2026-83609 xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg builder in lib/grammar.js compiles the anchored QNameexact validator with the multiline flag, so ^ and $ validate only one line instead of the complete...

CVE-2026-83609

xmldom (a pure JavaScript W3C XML DOM module) is vulnerable in versions 0.9.0 through 0.9.12 due to a flaw in lib/grammar.js. The shared reg() builder compiles the anchored QName_exact validator with the multiline flag , causing ^ and $ to validate only one line rather than the full name. As a re...

CVE-2026-15534

A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression...

Updated perl-HTTP-Date packages fix a security vulnerability

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parsedate...

MGASA-2026-0362 Updated perl-HTTP-Date packages fix a security vulnerability

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parsedate...

CVE-2026-82735

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.applyconstraints/2 lib/ash/type/string.ex evaluated the :match regex regardless of...

EEF-CVE-2026-82735 Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service

Summary Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.applyconstraints/2 lib/ash/type/string.ex evaluated the :match regex...

EUVD-2026-68962

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.applyconstraints/2 lib/ash/type/string.ex evaluated the :match regex regardless of...

CVE-2026-82735

ash-project ash (Elixir library) is affected by an uncontrolled resource consumption vulnerability in Ash.Type.String.apply_constraints/2 (lib/ash/type/string.ex). The :match regex was evaluated regardless of min_length/max_length constraints, so over-length input that should have been rejected b...

CVE-2026-82735 Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.applyconstraints/2 lib/ash/type/string.ex evaluated the :match regex regardless of...

CVE-2026-82735 Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.applyconstraints/2 lib/ash/type/string.ex evaluated the :match regex regardless of...

CVE-2026-82735 Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.applyconstraints/2 lib/ash/type/string.ex evaluated the :match regex regardless of...

CVE-2026-82735: Uncontrolled Resource Consumption

Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length constraint should have already rejected. Ash.Type.String.applyconstraints/2 lib/ash/type/string.ex evaluated the :match regex regardless of...

PT-2026-89832

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse date...

Security Vulnerabilities fixed in Thunderbird 155 — Mozilla

Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. A maliciously constructed mail header could lead to a one byte read past the end of a buffer. A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID...

PT-2026-84528

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153.2 Thunderbird versions prior to 155 Description The mail.allowed attachment hostnames advanced configuration setting is used in a regular expression without proper escaping. This flaw allows certain unintended...