CVE-2026-87721 Denial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code Review

Uncontrolled Resource Consumption CWE-400 / CWE-407 in the ANTLR 3 search query parser QueryParser / Query.g in Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker or an authenticated user if anonymous read...

CVE-2026-87721 Denial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code Review

Uncontrolled Resource Consumption CWE-400 / CWE-407 in the ANTLR 3 search query parser QueryParser / Query.g in Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker or an authenticated user if anonymous read...

CVE-2026-87721

Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 are vulnerable to Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g ). An unauthenticated remote attacker can trigger a persistent deni...

Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching

Problem descriptionProtego constructs regular expressions to match URLs against robots.txt Allow: and Disallow: directives, see protego.urlpattern.URLPattern.preparepatternforregex. Every in the directive value is translated into a lazy .? regex piece, thus a specially crafted directive value wit...

PYSEC-2026-3906 Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching

Problem description Protego constructs regular expressions to match URLs against robots.txt Allow: and Disallow: directives, see protego.urlpattern.URLPattern.preparepatternforregex. Every in the directive value is translated into a lazy .? regex piece, thus a specially crafted directive value wi...

CVE-2026-55520

A flaw was found in Protego, a pure-Python robots.txt parser. A remote attacker could exploit this vulnerability by providing a crafted robots.txt file containing numerous asterisks in Allow or Disallow directives. This causes exponential backtracking during URL wildcard matching, leading to a...

GHSA-WJMF-P669-5M5P Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching

Problem description Protego constructs regular expressions to match URLs against robots.txt Allow: and Disallow: directives, see protego.urlpattern.URLPattern.preparepatternforregex. Every in the directive value is translated into a lazy .? regex piece, thus a specially crafted directive value wi...

Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching

Problem description Protego constructs regular expressions to match URLs against robots.txt Allow: and Disallow: directives, see protego.urlpattern.URLPattern.preparepatternforregex. Every in the directive value is translated into a lazy .? regex piece, thus a specially crafted directive value wi...

CVE-2026-55520 Protego: Exponential backtracking ReDoS in robots.txt URL wildcard matching

Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego.urlpattern.URLPattern.preparepatternforregex translates every asterisk in an Allow or Disallow directive into a lazy regular-expression wildcard, so a directive containing many asterisks create...

EUVD-2026-67865

Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego.urlpattern.URLPattern.preparepatternforregex translates every asterisk in an Allow or Disallow directive into a lazy regular-expression wildcard, so a directive containing many asterisks create...

CVE-2026-55520 Protego: Exponential backtracking ReDoS in robots.txt URL wildcard matching

Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego.urlpattern.URLPattern.preparepatternforregex translates every asterisk in an Allow or Disallow directive into a lazy regular-expression wildcard, so a directive containing many asterisks create...

CVE-2026-55520 Protego: Exponential backtracking ReDoS in robots.txt URL wildcard matching

Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego.urlpattern.URLPattern.preparepatternforregex translates every asterisk in an Allow or Disallow directive into a lazy regular-expression wildcard, so a directive containing many asterisks create...

CVE-2026-55520

Protego is a pure-Python robots.txt parser. Prior to 0.6.2 , the _URLPattern._prepare_pattern_for_regex method in src/protego/_urlpattern.py translates every asterisk in an Allow or Disallow directive into a lazy regex wildcard. A directive containing many asterisks triggers exponential backtrack...

CVE-2026-55520: Uncontrolled Resource Consumption

Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego.urlpattern.URLPattern.preparepatternforregex translates every asterisk in an Allow or Disallow directive into a lazy regular-expression wildcard, so a directive containing many asterisks create...

CVE-2026-33607

An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are...

UBUNTU-CVE-2026-33607

An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are...

SUSE CVE-2026-79770

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Nodecss, Nodeatcss, and Searchablesearch to cause...

CVE-2026-79770 Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Nodecss, Nodeatcss, and Searchablesearch to cause...

CVE-2026-79770

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Nodecss, Nodeatcss, and Searchablesearch to cause...

CVE-2026-79770 Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Nodecss, Nodeatcss, and Searchablesearch to cause...