CVE-2026-87819 GitPython before 3.1.60 Denial of Service via ReDoS

GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.nameemailregex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic...

CVE-2026-87819

GitPython before 3.1.60 is vulnerable to a regular expression denial of service (ReDoS) in the Actor.name_email_regex pattern used to parse commit author and committer fields. An attacker can craft a commit object with a malformed author field containing an unterminated angle bracket , triggering...

CVE-2026-86081 n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-controlled destination path against the default N8NBLOCKFILEPATTERNS regular expression. The pattern ^./.git/.$ allowed catastrophic backtracking and ran...

CVE-2026-86081

n8n , an open-source workflow automation platform, is vulnerable to Regular Expression Denial of Service (ReDoS) in its Git node clone operation. Prior to versions 1.123.76 , 2.37.7 , and 2.38.2 , the default N8N_BLOCK_FILE_PATTERNS regex (^(./).git(/.)$) permitted catastrophic backtracking when ...

CVE-2026-86081 n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-controlled destination path against the default N8NBLOCKFILEPATTERNS regular expression. The pattern ^./.git/.$ allowed catastrophic backtracking and ran...

Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing

Summary @tiptap/core contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated QUOTED0 prefixes. Inline shortcode attributes use another unanchored greedy ke...

EUVD-2026-69248

xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser...

GHSA-X4FP-J954-R2F4 xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

Summary On the @xmldom/xmldom 0.8.x line, parsing an XML end tag whose name is followed by a long run of whitespace and then a non-whitespace character triggers quadratic-time regular-expression backtracking ReDoS, so a single small crafted end tag stalls the Node.js event loop. It is reachable...

Colord: Slow rejection of oversized malformed color strings

Impact colord's CSS color string matchers described a number as +-?\d.?\d+. In that form \d and \d+ can match the same digits, so a run of n digits can be divided between them in On² ways, and rejecting an input retries every division. Parsing is synchronous and uninterruptible, so a long...

GHSA-G53G-W8RJ-FMG7 xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

Summary @xmldom/xmldom's processing-instruction PI grammar regex exhibits quadratic-time backtracking ReDoS when parsing an unterminated processing instruction. A single small XML document containing forces the regular expression engine into On² work, stalling the Node.js event loop. The input is...

xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

Summary @xmldom/xmldom's processing-instruction PI grammar regex exhibits quadratic-time backtracking ReDoS when parsing an unterminated processing instruction. A single small XML document containing forces the regular expression engine into On² work, stalling the Node.js event loop. The input is...

GHSA-8MPW-7FPC-4GQJ NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks

Summary Pl196xCorpusReader still parses whole TEI blocks with multiple lazy regexes over attacker-controlled text. A malformed file with many opening tags and no matching closing tags forces repeated rescans and produces quadratic CPU growth in public reader APIs. Details - Vulnerability type:...

NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks

Summary Pl196xCorpusReader still parses whole TEI blocks with multiple lazy regexes over attacker-controlled text. A malformed file with many opening tags and no matching closing tags forces repeated rescans and produces quadratic CPU growth in public reader APIs. Details - Vulnerability type:...

GHSA-W3V8-GMH9-3WV7 NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions

Summary The NLTK tgrep module accepts user-supplied regular expressions and passes them to the Python re engine without a timeout or validation, enabling catastrophic backtracking ReDoS. Applications that expose the tgrep API to external input are vulnerable to a single-request denial of service...

NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions

Summary The NLTK tgrep module accepts user-supplied regular expressions and passes them to the Python re engine without a timeout or validation, enabling catastrophic backtracking ReDoS. Applications that expose the tgrep API to external input are vulnerable to a single-request denial of service...

EUVD-2026-66397

NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions...

NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions

Summary NLTK's Text.findall and TokenSearcher.findall methods accept user-supplied regular expressions and pass them to the Python re engine without timeout or validation, enabling catastrophic backtracking ReDoS. This issue is isolated to the nltk.text module and was resolved in a prior commit...

EUVD-2026-66396

NLTK: ReDoS in nltk.text.Text.findall via unvalidated user-supplied regular expressions...

GHSA-RRV8-H7P8-RX55 NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions

Summary NLTK's Text.findall and TokenSearcher.findall methods accept user-supplied regular expressions and pass them to the Python re engine without timeout or validation, enabling catastrophic backtracking ReDoS. This issue is isolated to the nltk.text module and was resolved in a prior commit...

ROS-20260907-73-0072

The vulnerability in python-pygments is related to the use of a regular expression c, which has an inefficient computational complexity. Exploiting this vulnerability may allow a remote attacker to cause a service failure...