13405 matches found
CVE-2026-110869
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection.actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with...
CVE-2026-110869
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection.actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with...
CVE-2026-110869
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection.actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with...
CVE-2026-110856
GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the reactorepoch pattern used by parseactoranddate on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch o...
CVE-2026-110856
GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the reactorepoch pattern used by parseactoranddate on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch o...
CVE-2026-110594
BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern...
EUVD-2026-101222
BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern...
CVE-2026-110594
BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern...
CVE-2026-82617
A flaw was found in Apache OpenNLP. The built-in regular expression patterns used for identifying email and URL strings contain inefficient nested repetitions. A remote attacker can exploit this flaw by submitting crafted text to an affected application, triggering excessive CPU consumption or...
BIT-ELASTICSEARCH-2026-102408 Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service
Inefficient Regular Expression Complexity CWE-1333 in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup CAPEC-492. The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators,...
RLSA-2026:81613 Important: pcre2 security update
The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. Security Fixes: pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular...
Exploit for Expression Language Injection in Apache Struts
CVE-2026-10...
DEBIAN-CVE-2026-110449
Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled...
CVE-2026-110449
Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled...
PT-2026-114183
Name of the Vulnerable Software and Affected Versions Nodemailer versions 3.0.0 through 10.0.12 Description A regular expression denial of service exists in the SMTPConnection. actionEHLO function. The four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that cause...
PT-2026-114036
šØ CVE-2026-110594 BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically...
CVE-2026-110869: Inefficient Regular Expression Complexity
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection.actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with...
CVE-2026-110856: Inefficient Regular Expression Complexity
GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the reactorepoch pattern used by parseactoranddate on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch o...
CVE-2026-110594: Inefficient Regular Expression Complexity
BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern...
CVE-2026-110449: Integer Overflow or Wraparound
Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled...