Regular Expression Denial of Service (ReDoS)

Overview @xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom Affected versions of this package are vulnerable to Regular Expressi...

CVE-2026-83606

A flaw was found in xmldom, a JavaScript XML DOM parser. This vulnerability, a Regular Expression Denial of Service ReDoS, occurs due to inefficient processing of unterminated processing instructions in XML input. A remote, unauthenticated attacker can send a specially crafted XML input, causing...

DEBIAN-CVE-2026-83619

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression / \t\n\r+$/g. For an end tag containing a long whitespace run...

CVE-2026-83619

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression / \t\n\r+$/g. For an end tag containing a long whitespace run...

AZL-99336 CVE-2026-83619 affecting package python-tensorboard 2.16.2-6

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression / \t\n\r+$/g. For an end tag containing a long whitespace run...

CVE-2026-83619

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression / \t\n\r+$/g. For an end tag containing a long whitespace run...

CVE-2026-83619

xmldom (a pure JavaScript W3C-compliant DOMParser and XMLSerializer module) is vulnerable to a ReDoS (Regular Expression Denial of Service) in versions 0.7.0 through 0.8.15 . The root cause is an unanchored global regex /[ \t\n\r]+$/g in lib/sax.js that trims end-tag names; when an end tag contai...

CVE-2026-83619 xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression / \t\n\r+$/g. For an end tag containing a long whitespace run...

CVE-2026-83619 xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression / \t\n\r+$/g. For an end tag containing a long whitespace run...

CVE-2026-83619 xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression / \t\n\r+$/g. For an end tag containing a long whitespace run...

Regular Expression Denial of Service (ReDoS)

Overview @xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom Affected versions of this package are vulnerable to Regular Expressi...

CVE-2026-83606 xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0-beta.9 until 0.9.11, the processing-instruction production in lib/grammar.js lets the greedy S+ separator and lazy Char? data group repeatedly repartition a long whitespace tail when...

CVE-2026-83606 xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0-beta.9 until 0.9.11, the processing-instruction production in lib/grammar.js lets the greedy S+ separator and lazy Char? data group repeatedly repartition a long whitespace tail when...

CVE-2026-83606

@xmldom/xmldom (a pure-JavaScript DOMParser/XMLSerializer module) is affected by a Regular Expression Denial of Service (ReDoS) in its processing-instruction grammar between versions 0.9.0-beta.9 and 0.9.11 . The root cause is a quadratic backtracking pattern in lib/grammar.js, where a greedy S+ ...

CVE-2026-83606 xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0-beta.9 until 0.9.11, the processing-instruction production in lib/grammar.js lets the greedy S+ separator and lazy Char? data group repeatedly repartition a long whitespace tail when...

CVE-2026-83606

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0-beta.9 until 0.9.11, the processing-instruction production in lib/grammar.js lets the greedy S+ separator and lazy Char? data group repeatedly repartition a long whitespace tail when...

CVE-2026-55520

A flaw was found in Protego, a pure-Python robots.txt parser. A remote attacker could exploit this vulnerability by providing a crafted robots.txt file containing numerous asterisks in Allow or Disallow directives. This causes exponential backtracking during URL wildcard matching, leading to a...

CVE-2024-58379

A flaw was found in Nodemailer. A remote attacker can exploit a regular expression denial of service ReDoS vulnerability by sending specially crafted emails containing malicious data URLs or embedded attachments. This can cause the email parsing process to hang, leading to a denial of service for...

CVE-2026-81725

A flaw was found in NLTK, specifically within the Pl196xCorpusReader component. A remote attacker can exploit this by supplying malformed Text Encoding Initiative TEI blocks containing numerous unmatched opening tags. This triggers a regular expression denial of service ReDoS vulnerability, causi...

Security update for python-sqlparse

This update for python-sqlparse fixes the following issues: CVE-2026-54284: TokenList.init materializes Osubtree value per group, causing CPU DoS before depth/token caps trigger bsc1275459. CVE-2026-59893: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS bsc1275461...