4955 matches found
Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
============================================================================ ReDoS in XbmImagePlugin: 512-byte file stalls Image.open for minutes Location: src/PIL/XbmImagePlugin.py:58 in XbmImageFile.open Commit: a707c6b21c313880d0771e54965d142dd42358b6...
GHSA-XGH8-JP6Q-P5X8 Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
============================================================================ ReDoS in XbmImagePlugin: 512-byte file stalls Image.open for minutes Location: src/PIL/XbmImagePlugin.py:58 in XbmImageFile.open Commit: a707c6b21c313880d0771e54965d142dd42358b6...
git-vuln-finder
git-vuln-finder Finding potential software vulnerabilities from git commit messages. The output format is a JSON with the associated commit which could contain a fix regarding a software vulnerability. The search is based on a set of regular expressions against the commit messages only. If CVE ID...
exploit-workshop
exploit-workshop In this step by step workshop you'll learn how to exploit various real world vulnerabilities existing in vulnerable versions of packages in a Node.js and Java application. Required software you need to install for this workshop You can do this workshop in 2 different flavours Usi...
com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking
A flaw was found in jackson-core. An attacker can supply specially crafted JSON that, when deserialized into a numeric target type, triggers a Regular expression Denial of Service ReDoS vulnerability. This occurs due to quadratic backtracking in the NumberInput.looksLikeValidNumber method's...
regexploit
Regexploit Find regexes which are vulnerable to Regular Expression Denial of Service ReDoS. More info onthe Doyensec blog Many default regular expression parsers have unbounded worst-case complexity. Regex matching may be quick when presented with a matching input string. However, certain...
CVE-2020-5236
Waitress 1.4.2 ReDoS - CVE-2020-5236 Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the...
CVE-2024-22640
CVE-2024-22640 Vulnerability Type Regular expression Denial of Service ReDoS Affected Product and Version TCPDF convertHTMLColorToDec'"t"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000!',$ref; ? Note: Checking with...
CVE-2024-27088
CVE-2024-27088 취약점 개요 CVE-2024-27088 Feb 26, 2024 ReDoS in node.js package rebob 프로젝트의 일환 취약점 설명 github advisories /^\sfunction\s\0-'-\uffff+\s\0--\uffff\s/ This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently...
CVE-2023-43646
CVE-2023-43646 Vulnerability Overview CVE-2023-43646 CVSS : 8.6 Sep 26, 2023 ReDoS in node.js package Part of the rebob project Vulnerability Description github advisories /\sfunction?:\s|\s/^?:/+/\s^\/+/ This vulnerability can be exploited when there is an imbalance in parentheses, which results...
axios-redos
Axios Regular Expression Denial Of Service Attack This repo hold a POC of CVE-2021-3749. Overview A ReDoS regular expression denial of service flaw was found in the axios package. An attacker that is able to provide crafted input to the trim function may cause an application to consume an excessi...
CVE-2026-112901 Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile.open, when an application calls Image.open on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the attacker-controlle...
CVE-2026-112901
The Pillow Python imaging library is vulnerable to a regular-expression denial of service (ReDoS) in its XBM header parser prior to version 13.0.0 . Specifically, in the XbmImageFile._open function, the XbmImagePlugin applies a backtracking expression to an attacker-controlled header when an appl...
CVE-2026-112901 Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile.open, when an application calls Image.open on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the attacker-controlle...
CVE-2026-112300 DiffSK configobj __init__.py _sectionmarker redos
A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function sectionmarker of the file configobj/init.py. The manipulation leads to inefficient regular expression complexity. Remote exploitation of the attack is possible. The project was informed ...
CVE-2026-112300 DiffSK configobj __init__.py _sectionmarker redos
A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function sectionmarker of the file configobj/init.py. The manipulation leads to inefficient regular expression complexity. Remote exploitation of the attack is possible. The project was informed ...
CVE-2026-112300
A Regular Expression Denial of Service (ReDoS ) vulnerability exists in DiffSK configobj up to version 5.0.9 . The flaw is located within the _sectionmarker function of the configobj/init .py file. This issue arises from inefficient regular expression complexity, which could allow for remote expl...
CVE-2022-45729
This repository does not have a README...
Regular Expression Denial of Service (ReDoS)
Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via analyzeRepeatedExtglob in lib/parse.js, which skips single-branch repeated extglob patterns such as + or +a. An attacker can supply these glob patterns to trigger exponential backtracking i...