CVE-2026-103043

anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js...

CVE-2026-103043 anchorme through 3.0.8 Regular Expression Denial of Service

anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js...

CVE-2026-103043

The anchorme library (versions through 3.0.8 ) is vulnerable to a Regular Expression Denial of Service (ReDoS) . The issue resides in the IPv6 host extraction regex , where catastrophic backtracking can be triggered by specially crafted input strings with repeated patterns. This causes exponentia...

CVE-2026-103043 anchorme through 3.0.8 Regular Expression Denial of Service

anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js...

regexploit

Regexploit 寻找易受正则表达式拒绝服务（ReDoS）攻击的正则表达式。 更多信息请参见Doyensec 博客 许多默认的正则表达式解析器具有无界的最坏情况复杂度。当输入字符串匹配时，正则表达式匹配可能很快。然而，某些不匹配的输入字符串会使正则表达式匹配器陷入疯狂的回溯循环，并花费大量时间处理。这可能导致拒绝服务，因为CPU将被卡住尝试匹配正则表达式。 该工具旨在： 查找易受ReDoS攻击的正则表达式 给出一个会导致灾难性回溯的恶意字符串示例 最坏情况复杂度 这反映了正则表达式匹配器回溯过程的复杂度与输入字符串长度的关系。...

CVE-2020-5236

Waitress 1.4.2 ReDoS - CVE-2020-5236 Waitress versión 1.4.2 permite un ataque DoS. Cuando Waitress recibe una cabecera que contiene caracteres inválidos. Cuando una cabecera como "Bad-header: xxxxxxxxxxxxxxx\x10" es recibida, provocará que el motor de expresiones regulares realice un retroceso...

Security Bulletin: Threat Intelligence App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Threat Intelligence App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-33671 DESCRIPTION: Picomatch i...

JLine: ReDoS in Nano Editor Regex Search Mode

Summary When regex search mode is enabled in the JLine3 nano editor, the user-supplied search term is compiled directly as a Java regular expression with no timeout or backtracking bound. A crafted pattern such as a++b can hang the editor session thread at high CPU, causing a denial of service fo...

GHSA-PH9C-7HW9-VHHW JLine: ReDoS in Nano Editor Regex Search Mode

Summary When regex search mode is enabled in the JLine3 nano editor, the user-supplied search term is compiled directly as a Java regular expression with no timeout or backtracking bound. A crafted pattern such as a++b can hang the editor session thread at high CPU, causing a denial of service fo...

JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping

Summary The JLine3 built-in grep command wraps the user-supplied regular expression with . before compiling it with Java's backtracking regex engine. This amplifies catastrophic backtracking and allows a short pattern such as a++b to hang the command thread on non-matching input. In environments...

GHSA-R2XF-8XR9-62GW JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping

Summary The JLine3 built-in grep command wraps the user-supplied regular expression with . before compiling it with Java's backtracking regex engine. This amplifies catastrophic backtracking and allows a short pattern such as a++b to hang the command thread on non-matching input. In environments...

GHSA-5Q95-HRPC-M3W3 JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable

Summary The JLine3 HISTORYIGNORE variable is converted into a Java regular expression with only partial escaping. As a result, regex metacharacters other than and : are passed through to the regex engine. A crafted value such as a++b can cause catastrophic backtracking each time a command line is...

JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable

Summary The JLine3 HISTORYIGNORE variable is converted into a Java regular expression with only partial escaping. As a result, regex metacharacters other than and : are passed through to the regex engine. A crafted value such as a++b can cause catastrophic backtracking each time a command line is...

EUVD-2026-84198

Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff pathFilters...

Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`

Affected component: Sync-in Server v2.3.0, POST /api/app/sync/operation/diff/:id, vulnerable implementation of pathFilters in backend/src/applications/sync/dtos/sync-operations.dto.ts. Summary In the vulnerable version, the sync diff endpoint accepted a user-controlled regex pattern through...

CVE-2026-58270

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a RegExp with no complexity validation. A catastrophic-backtracking pattern e.g. ^a++b blocks the Node.js event loop...

CVE-2026-58270

Sync-in Server , an open-source platform for file storage, sharing, and syncing, is vulnerable to a ReDoS (Regular Expression Denial of Service) in the sync diff pathFilters parameter prior to version 2.4.0 . The endpoint compiles a user-supplied string directly into a RegExp without complexity v...

Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0, 1.2.0 by vulnerabilities in the packages picomatch-2.3.1.tgz.

Summary Impacted IBM Optim 1.0.0, 1.1.0, 1.2.0 by vulnerabilities in the packages picomatch-2.3.1.tgz. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2026-33671 DESCRIPTION: Picomatch is a glob...

CVE-2026-58270: Inefficient Regular Expression Complexity

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a RegExp with no complexity validation. A catastrophic-backtracking pattern e.g. ^a++b blocks the Node.js event loop...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-49476, CVE-2026-49477)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-49476 DESCRIPTION: Soup Sieve is a CSS selector...