Rocky Linux 9 [CIQ] Security Update: perl / perl-Attribute-Handlers / perl-AutoLoader / perl-AutoSplit / etc (crlsa-2026_67155)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202667155 advisory. perl: Perl: Incorrect regular expression processing via large regular expressions CVE-2026-13221 Tenable has extracted the preceding description block directly fro...

CentOS Linux 7 [TuxCare] Security Update: perl / perl-CPAN / perl-ExtUtils-CBuilder / perl-ExtUtils-Embed / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1784295411)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1784295411 advisory. - Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expressi...

Rocky Linux 8 [CIQ] Security Update: perl / perl-Attribute-Handlers / perl-Devel-Peek / etc (crlsa-2026_67162)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202667162 advisory. perl: Perl: Incorrect regular expression processing via large regular expressions CVE-2026-13221 Tenable has extracted the preceding description block directly fro...

Rocky Linux 10.2 [CIQ] Security Update: perl / perl-Attribute-Handlers / perl-AutoLoader / perl-AutoSplit / etc (crlsa-2026_67156)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202667156 advisory. perl: Perl: Incorrect regular expression processing via large regular expressions CVE-2026-13221 Tenable has extracted the preceding description block directly...

CentOS Linux 8.5 [TuxCare] Security Update: perl / perl-Attribute-Handlers / perl-Devel-Peek / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1784303988)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1784303988 advisory. - Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular...

Incorrect Regular Expression

Overview Affected versions of this package are vulnerable to Incorrect Regular Expression in the escapeRegex function in index.js, which escapes , , /, , , , +, ?, ., and $ but leaves ^, |, , , and intact, and whose output is joined into the alternation that the RedirectableRequest constructor...

Incorrect Regular Expression

Overview Affected versions of this package are vulnerable to Incorrect Regular Expression in the escapeRegex function in index.js, which escapes , , /, , , , +, ?, ., and $ but leaves ^, |, , , and intact, and whose output is joined into the alternation that the RedirectableRequest constructor...

CVE-2026-88021: Incorrect Regular Expression

Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not authorized to access. When building Envoy RBAC rules to enforce Connect intentions, Consul did not correctly escape certain characters in...

CVE-2026-19487: Always-Incorrect Control Flow Implementation

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...

CVE-2026-73425: Incorrect Regular Expression

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remoteimages for Netlify's Image CDN allowlist. In...

CVE-2026-64655: Incorrect Regular Expression

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

CVE-2026-45065: Incorrect Regular Expression

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, UrlGenerator validates route parameters against a pattern built as ^ plus the raw requirement plus $; with ungrouped alternations, middle alternatives mat...

CVE-2026-56021: Incorrect Regular Expression

Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern...

Incorrect Regular Expression

Overview org.webjars.npm:hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Incorrect Regular Expression via the ip-restriction middleware. An attacker can bypass configured deny rules for IPv6 addresses by submitting non-canonical representations...

Incorrect Regular Expression

Overview symfony/symfony is a PHP framework for web applications and a set of reusable PHP components. Affected versions of this package are vulnerable to Incorrect Regular Expression in the route URL requirements when a requirement is set as an alternation such as locale: 'ar|bg|...|vi|...|zhCN'...

Incorrect Regular Expression

Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Incorrect Regular Expression in the Content-Type header validation. An attacker can cause the server to incorrectly process requests with malformed Content-Type headers by sending value...

Incorrect Regular Expression

Overview fast-xml-parser is a Validate XML, Parse XML, Build XML without C/C++ based libraries Affected versions of this package are vulnerable to Incorrect Regular Expression in the entity parsing RegEx in DOCTYPE declarations. An attacker can inject arbitrary values that override built-in XML...

Incorrect Regular Expression

Overview org.webjars.npm:fast-xml-parser is a Validate XML, Parse XML, Build XML without C/C++ based libraries Affected versions of this package are vulnerable to Incorrect Regular Expression in the entity parsing RegEx in DOCTYPE declarations. An attacker can inject arbitrary values that overrid...

Incorrect Regular Expression

Overview litestar is a Litestar - A production-ready, highly performant, extensible ASGI API Framework Affected versions of this package are vulnerable to Incorrect Regular Expression via the allowedhosts host validation. An attacker can gain unauthorized access by supplying a specially crafted...

Incorrect Regular Expression

Overview org.webjars.npm:hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Incorrect Regular Expression in the form of the IPV4REGEX pattern not properly matching IPv4 octet ranges, and passing values above 255 on to convertIPv4ToBinary. An...