The vulnerability of the CGI Gem software lies in the use of regular expressions with inefficient computational complexity, which allows attackers to trigger a service failure.

The vulnerability of the CGI Gem software lies in the use of a regular expression with inefficient computational complexity. Exploiting this vulnerability allows an attacker operating remotely to cause service interruptions...

uBlock Origin 安全漏洞

uBlock Origin uBO is an efficient blocker for uBlock Origin-Chromium and Firefox by Raymond Hill Personal Developer. A security vulnerability exists in uBlock Origin 1.63.3b16 and earlier versions, which stems from improper regular expression complexity and could lead to a denial of service attac...

transformers 安全漏洞

transformers is a Hugging Face open source application for machine learning. A security vulnerability exists in transformers version 4.48.1, which stems from exponential complexity in regular expressions when processing specially crafted inputs, potentially leading to a denial of service...

Amazon Linux 2 : runc (ALASDOCKER-2025-059)

The version of runc installed on the remote host is prior to 1.1.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2025-059 advisory. Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to...

Amazon Linux 2 : docker (ALASECS-2025-059)

The version of docker installed on the remote host is prior to 20.10.17-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2025-059 advisory. Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read t...

Amazon Linux 2 : runc (ALASECS-2025-058)

The version of runc installed on the remote host is prior to 1.1.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2025-058 advisory. Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to...

Medium: containerd

Issue Overview: Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2025-058)

The version of containerd installed on the remote host is prior to 1.6.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2025-058 advisory. Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could...

Amazon Linux 2 : runc (ALASNITRO-ENCLAVES-2025-056)

The version of runc installed on the remote host is prior to 1.1.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2025-056 advisory. Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause...

ROS-20250417-12

Vulnerability in cgi gem software tool due to insufficient input validation when processing unreliable input using regular expressions in CGI::UtilescapeElement. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service Vulnerability in the cgi gem...

Prototype Pollution

estree-util-value-to-estree is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of object properties due to generating ESTree expressions that interpret proto as a prototype rather than a normal property...

The vulnerability of the tracing component of the eventtrigger_write function in the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability of the tracing component of the eventtriggerwrite function in Linux kernel is related to insufficient handling of regular expressions. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

libxslt: Use-After-Free in libxslt numbers.c

A flaw was found in libxslt numbers.c. This vulnerability allows a use-after-free, potentially leading to memory corruption or code execution via nested XPath evaluations where an XPath context node can be modified but not restored...

AIDE 0.19

AIDE Advanced Intrusion Detection Environment is a free replacement for Tripwiretm. It generates a database that can be used to check the integrity of files on server. It uses regular expressions for determining which files get added to the database. You can use several message digest algorithms ...

PT-2025-16186 · Git +1 · Javaparser

Name of the Vulnerable Software and Affected Versions: JavaParser affected versions not specified Description: The software is susceptible to a security exception triggered during the parsing of Java expressions. The crash state involves com.github.javaparser.GeneratedJavaParser.Expression,...

DEBIAN-CVE-2025-26619

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In vega 5.30.0 and lower and in vega-functions 5.15.0 and lower , it was possible to call JavaScript functions from the Vega expression language that were not meant to be...

Unspecified vulnerability in Lunary (CNVD-2025-06940)

Lunary is Lunary open source a production toolkit for LLM . A security vulnerability exists in Lunary version 105a3f6 that originates from allowing users to upload and execute arbitrary regular expressions, which can be exploited by an attacker to potentially cause a regular expression denial of...

lunary denial of service vulnerability (CNVD-2025-07601)

lunary is lunary open source a production toolkit for LLM . A denial of service vulnerability exists in lunary that stems from the use of insecure regular expressions in the /v1/checklists endpoint. An attacker can exploit this vulnerability to cause a denial of service...

GPT Academic Denial of Service Vulnerability (CNVD-2025-22736)

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a denial of service vulnerability that stems from the use of insecure regular expressions. An attacker could exploit this vulnerability to cause a regular...

The vulnerability of the GeoTools library, a software solution for managing and publishing geospatial data on the OSGeo GeoServer server, arises from improper code generation management. This vulnerability allows an attacker to execute arbitrary code.

The vulnerability of the GeoTools library, a software solution for managing and publishing geospatial data on the OSGeo GeoServer server, is related to improper handling of code generation. Exploiting this vulnerability could allow an attacker, operating remotely, to execute arbitrary code by...