CVE-2026-15154: Inefficient Regular Expression Complexity

A flaw was found in guardrails-detectors, a component of Red Hat OpenShift AI. This vulnerability, known as Regular Expression Denial of Service ReDoS, allows a remote attacker to provide specially crafted regular expressions to the public detection API. This can cause catastrophic backtracking,...

CVE-2026-14895 String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service

String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. The trim and rtrim functions stripped trailing whitespace with s/\s$//u. Because \s matches greedily and the $ anchor fails whenever a non-whitespace character follows the whitespace, the regex...

CVE-2026-14895

String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. The trim and rtrim functions stripped trailing whitespace with s/\s$//u. Because \s matches greedily and the $ anchor fails whenever a non-whitespace character follows the whitespace, the regex...

PYSEC-2026-1359 fastapi-guard is vulnerable to ReDoS through inefficient regex

Summary fastapi-guard detects penetration attempts by using regex patterns to scan incoming requests. However, some of the regex patterns used in detection are extremely inefficient and can cause polynomial complexity backtracks when handling specially crafted inputs. It is not as severe as...

fastapi-guard is vulnerable to ReDoS through inefficient regex

Summaryfastapi-guard detects penetration attempts by using regex patterns to scan incoming requests. However, some of the regex patterns used in detection are extremely inefficient and can cause polynomial complexity backtracks when handling specially crafted inputs.It is not as severe as...

PYSEC-2026-1979 Transformers vulnerable to ReDoS attack through its SETTING_RE variable

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the SETTINGRE variable within the transformers/commands/chat.py file. The...

PYSEC-2026-1440 H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint

A vulnerability in the /3/ParseSetup endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service DoS attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity,...

ReDoS in giskard's transformation.py (GHSL-2024-324)

ReDoS in Giskard text perturbation detectorA Remote Code Execution ReDoS vulnerability was discovered in Giskard component by the GitHub Security Lab team. When processing datasets with specific text patterns with Giskard detectors, this vulnerability could trigger exponential regex evaluation...

PYSEC-2026-1403 ReDoS in giskard's transformation.py (GHSL-2024-324)

ReDoS in Giskard text perturbation detector A Remote Code Execution ReDoS vulnerability was discovered in Giskard component by the GitHub Security Lab team. When processing datasets with specific text patterns with Giskard detectors, this vulnerability could trigger exponential regex evaluation...

USN-8515-1 ruby-addressable vulnerability

It was discovered that Addressable incorrectly handled certain URI templates, generating regular expressions vulnerable to catastrophic backtracking. An attacker could use this issue to craft a URI that, when matched against a vulnerable template, causes excessive resource consumption, leading to...

USN-8515-1: Addressable vulnerability

It was discovered that Addressable incorrectly handled certain URI templates, generating regular expressions vulnerable to catastrophic backtracking. An attacker could use this issue to craft a URI that, when matched against a vulnerable template, causes excessive resource consumption, leading to...

PT-2026-56275

Name of the Vulnerable Software and Affected Versions String::Util versions prior to 1.36 Description String::Util for Perl is susceptible to a regular expression denial of service. The trim and rtrim functions use a regular expression to strip trailing whitespace. Because the s pattern matches...

SUSE CVE-2026-44496

Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who...

Regular Expression Denial of Service (ReDoS)

Overview org.webjars.npm:jsonata is a JSON query and transformation language Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the $toMillis function. An attacker can cause resource exhaustion by providing specially crafted inputs that trigger...

soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings

A flaw was found in soupsieve, a CSS selector library. This vulnerability allows a remote attacker to cause a Denial of Service DoS by supplying specially crafted, untrusted CSS selector strings. The flaw occurs due to a regular expression vulnerable to catastrophic backtracking when processing a...

PT-2026-97439

Name of the Vulnerable Software and Affected Versions JLine versions 3.0.0 through 3.30.14 JLine versions prior to 4.3.1 Description The built-in grep command in the PosixCommands.java file accepts a user-controlled regular expression in the grep function. Unless line-regexp mode is used, the...

Astra Linux – Vulnerability in libssh

A flaw was discovered in libssh. A remote attacker, by controlling client configuration files or knownhosts files, could create specific hostnames that, when processed by the matchpattern function, could lead to inefficient regular expression backtracking. This could cause timeouts and resource...

Duplicate Advisory: vLLM Vulnerable to Regular Expression Denial of Service

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-j828-28rj-hfhp. This link is maintained to preserve external references. Original Description vLLM versions = 0.6.3 and 0.9.0 contain multiple regular expression denial of service ReDoS vulnerabilities. Several...

GHSA-VFM7-4H43-GP6M Duplicate Advisory: vLLM Vulnerable to Regular Expression Denial of Service

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-j828-28rj-hfhp. This link is maintained to preserve external references. Original Description vLLM versions = 0.6.3 and 0.9.0 contain multiple regular expression denial of service ReDoS vulnerabilities. Several...

CVE-2025-71379 vllm - Regular Expression Denial of Service in Multiple Components

vLLM versions = 0.6.3 and 0.9.0 contain multiple regular expression denial of service ReDoS vulnerabilities. Several regex patterns — in vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint — are susceptible to catastrophic backtracking. An attacker...