Linux Distros Unpatched Vulnerability : CVE-2026-104150

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by...

CVE-2026-104150

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an...

CVE-2026-104150 AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an...

CVE-2026-104150 AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an...

EUVD-2026-102320

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an...

CVE-2026-104150

The AdonisJS HTTP Server package (prior to versions 8.2.2 and 9.1.1 ) is vulnerable to Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity (CWE-400, CWE-1333). The router.matchers.slug() function contains a regular expression with adjacent greedy repetitions and overla...

EUVD-2026-101739

GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the reactorepoch pattern used by parseactoranddate on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch o...

CVE-2026-110856

A flaw was found in GitPython. A remote attacker can trigger a Denial of Service DoS by providing a malicious repository containing commit or tag objects with long, space-filled lines lacking a valid timestamp or timezone. When parsing these lines, the regular expression pattern triggers quadrati...

DEBIAN-CVE-2026-110856

GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the reactorepoch pattern used by parseactoranddate on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch o...

CVE-2026-110856

GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the reactorepoch pattern used by parseactoranddate on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch o...

CVE-2026-110856 GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date

GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the reactorepoch pattern used by parseactoranddate on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch o...

CVE-2026-110856

GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the reactorepoch pattern used by parseactoranddate on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch o...

CVE-2026-110856 GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date

GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the reactorepoch pattern used by parseactoranddate on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch o...

CVE-2026-110856: Inefficient Regular Expression Complexity

GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the reactorepoch pattern used by parseactoranddate on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch o...

CVE-2026-109563: Inefficient Regular Expression Complexity

N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event...

jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()

Status FULLY REPRODUCED with a clean, textbook empirical signature: measured runtime grew almost exactly 4x for every doubling of input size across five consecutive doublings 5,000 → 160,000 characters, confirming On² behavior. A single 160,000-character string smaller than a typical HTTP request...

GHSA-P6PP-M3F8-5C89 jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()

Status FULLY REPRODUCED with a clean, textbook empirical signature: measured runtime grew almost exactly 4x for every doubling of input size across five consecutive doublings 5,000 → 160,000 characters, confirming On² behavior. A single 160,000-character string smaller than a typical HTTP request...

Regular Expression Denial Of Service

Axios is vulnerable to a Regular Expression Denial Of Service. The vulnerability is due to quadratic backtracking in the regular expression used by shouldBypassProxy, where the pattern hostname.replace/\.+$/, '' scans a hostname composed of many dots followed by a non‑dot character, and an...

AlmaLinux 9.2 [TuxCare] Security Update: perl-Date-Manip (ALMALINUX9.2:CLSA-2026:1788262245)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788262245 advisory. - Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in parsetime...

GHSA-G5VV-9GXW-82HX GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing

Summary GitPython's Actor.nameemailregex regular expression git/util.py, line 863 is vulnerable to catastrophic backtracking ReDoS — Regular Expression Denial of Service. When GitPython parses the author or committer header of a git commit object that contains a long string with an unterminated ,...