GHSA-2G7P-5934-Q4W7 Payload: ReDoS in Multipart Content-Type Validation

Impact A malformed multipart request body could take an extremely long time to finish. Patches Users should upgrade Payload packages to = 3.90.0 or = 4.0.0-canary.34...

CVE-2026-105854 Payload: ReDoS in Multipart Content-Type Validation

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type processing to take an extremely long time, resulting in uncontrolled resource...

CVE-2026-105854 Payload: ReDoS in Multipart Content-Type Validation

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type processing to take an extremely long time, resulting in uncontrolled resource...

CVE-2026-105854 Payload: ReDoS in Multipart Content-Type Validation

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type processing to take an extremely long time, resulting in uncontrolled resource...

CVE-2026-105854

The Payload headless content management system is vulnerable to a Regular Expression Denial of Service (ReDoS) . In versions 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34 , a malformed multipart request body can cause the multipart Content-Type processing to take an extremely lon...

Security Bulletin: middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen separated subtags.

Summary Upgrade to InformixHQ 3.3.2 included in 14.10.14W1 and 15.0.1.16 Vulnerability Details CVEID:CVE-2026-69207 DESCRIPTION: Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34, the built-in CORS middleware, hono/cors, is vulnerable to a...

CVE-2026-105646 Ghost: Regular Expression Denial of Service in Content Import

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

CVE-2026-105645 Ghost: Regular Expression Denial of Service in External Media Inliner

Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

CVE-2023-32309

CVE-2023-32309...

CVE-2020-5236

Waitress 1.4.2 ReDoS - CVE-2020-5236 يتيح إصدار Waitress 1.4.2 شن هجوم حجب الخدمة DoS. فعندما يستقبل Waitress ترويسة تحتوي على أحرف غير صالحة، مثل ترويسة بالشكل "Bad-header: xxxxxxxxxxxxxxx\x10"، فإن ذلك يؤدي إلى تراجع كارثي في محرك التعبير النمطي regex، ما يسبب استهلاك العملية 100% من زمن المعال...

Astra Linux – Vulnerability in node-semver

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service ReDoS via the function new Range, when untrusted user data is provided as a range...

Astra Linux – Vulnerability in node-minimatch

Minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, matchOne performed unbounded recursive backtracking when a glob pattern contained multiple non-adjacent GLOBSTAR...

Astra Linux – Vulnerability in node-ajv

The ajv Another JSON Schema Validator before version 8.18.0 is vulnerable to Regular Expression Denial of Service ReDoS when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax $data reference, which is passed directly to the JavaScript RegExp constructor...

Astra Linux – Vulnerability in Jinja2

This issue affects the Jinja2 package versions starting from 0.0.0 and earlier than 2.11.3. The ReDoS vulnerability is primarily caused by the punctuationre regex operator and its use of multiple wildcards. The last wildcard is the most exploitable, as it is used to search for trailing punctuatio...

CVE-2023-4220

CVE-2023-4220...

CVE-2023-31606

CVE-2023-31606 الثغرة تم اكتشاف مشكلة رفض الخدمة عبر التعبيرات النمطية ReDoS في دالة sanitizehtml الخاصة بـ redcloth gem الإصدار = v4.0.0. تسمح هذه الثغرة للمهاجمين بالتسبب في رفض الخدمة DoS عبر إرسال حمولة مصممة بعناية. ما هو ReDoS؟ وفقًا لـ OWASP - يُعد رفض الخدمة عبر التعبيرات النمطية ReDoS...

Regular Expression Denial of Service (ReDoS)

Overview mammoth is a Convert Word documents from docx to simple HTML and Markdown Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supp...

CVE-2026-105219 Mammoth.js 1.3.0 before 1.12.3 ReDoS via Style Map Tokeniser

Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in...

CVE-2026-105219 Mammoth.js 1.3.0 before 1.12.3 ReDoS via Style Map Tokeniser

Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in...

CVE-2026-105219

Mammoth.js versions 1.3.0 before 1.12.3 are vulnerable to a Regular Expression Denial of Service (ReDoS) . The flaw exists in the style map tokeniser located in lib/styles/parser/tokeniser.js due to overlapping regex alternatives . An attacker can provide a crafted .docx file containing an unterm...