CVE-2026-105219 Mammoth.js 1.3.0 before 1.12.3 ReDoS via Style Map Tokeniser

Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an unterminated quoted string of repeated backslash escapes in...

CVE-2023-27704

CVE-2023-27704 CVE-2023-27704 Void Tools Everything lower than v1.4.1.1022 was discovered to contain a Regular Expression Denial of Service ReDoS fix at Everything 1.5 alpha Suggested description Void Tools Everything lower than v1.4.1.1022 was discovered to contain a Regular Expression Denial of...

CVE-2026-87819

A flaw was found in GitPython. A remote attacker could exploit a regular expression denial of service ReDoS vulnerability by crafting a malicious commit object. Specifically, a malformed author field containing an unterminated angle bracket can cause excessive processing, leading to the exhaustio...

GHSA-MHVH-FQ92-PFMR geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point

Impact geopy.Point and Point.fromstring may take excessive CPU time when parsing long, malformed coordinate strings due to inefficient regular-expression behavior. The numeric Point constructor is not affected. Geocoders' reverse methods called with string inputs exercise the vulnerable path...

geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point

Impact geopy.Point and Point.fromstring may take excessive CPU time when parsing long, malformed coordinate strings due to inefficient regular-expression behavior. The numeric Point constructor is not affected. Geocoders' reverse methods called with string inputs exercise the vulnerable path...

Security Bulletin: Vulnerability in markdown-it package bundled with IBM Fusion, IBM Fusion HCI, IBM Fusion Data Cataloging and IBM Fusion Content-Aware Storage.

Summary IBM Fusion, IBM Fusion HCI, IBM Fusion Data Cataloging, and IBM Fusion Content-Aware Storage include the markdown-it library, which is affected by a denial of service vulnerability. CVE-2026-2327. Vulnerability Details CVEID:CVE-2026-2327 DESCRIPTION: Versions of the package markdown-it...

Security Bulletin: Due to use of minimatch, IBM Cloud Pak System is affected by vunerability [CVE-2026-26996]

Summary Vulnerability was addressed by IBM Cloud Pak System v2.3.6.2. Vulnerability Details CVEID:CVE-2026-26996 DESCRIPTION: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Deni...

CVE-2026-104454 YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an On^2 markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool...

CVE-2026-104454 YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an On^2 markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool...

CVE-2026-104454 YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an On^2 markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS through inefficient evaluation of regular expressions in the Lua bindings. An attacker can cause excessive resource consumption and disrupt service availability by sending specially crafted inp...

EUVD-2026-91753

crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in Mistral model capability matching on Ruby 3.1.x...

CVE-2026-77387 geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point

geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.fromstring can spend excessive CPU time due to inefficient regular-expression behavior when an application passes a long malformed coordinate string without the 256-character input limit used by the fix. Geocoder rever...

CVE-2026-77387 geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point

geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.fromstring can spend excessive CPU time due to inefficient regular-expression behavior when an application passes a long malformed coordinate string without the 256-character input limit used by the fix. Geocoder rever...

CVE-2026-77387 geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point

geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.fromstring can spend excessive CPU time due to inefficient regular-expression behavior when an application passes a long malformed coordinate string without the 256-character input limit used by the fix. Geocoder rever...

CVE-2026-77387

The geopy Python geocoding library is vulnerable to a Regular Expression Denial of Service (ReDoS) in the geopy.Point and Point.from_string() functions. The root cause is inefficient regular-expression behavior when processing long malformed coordinate strings that exceed the 256-character limit ...

PYSEC-2026-4148 PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

Summary There is a Re-DoS vulnerability in the ispemformat function which results in a intesive CPU usage if an attacker is been able to provide a custom certificate. Details The problem is that the lazy quantifier .+? will always first try to match as little as possible until it finds a ---- END...

PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

SummaryThere is a Re-DoS vulnerability in the ispemformat function which results in a intesive CPU usage if an attacker is been able to provide a custom certificate. DetailsThe problem is that the lazy quantifier .+? will always first try to match as little as possible until it finds a ---- END...

Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns

Summarysoupsieve compiles CSS selector strings with a set of hand-written regular expressions. The shared IDENTIFIER sub-pattern also embedded in VALUE, and therefore in attribute selectors places two adjacent quantified groups over overlapping character classes: ?:classA|ESC+?:classB|ESC, where...

PYSEC-2026-4170 Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns

Summary soupsieve compiles CSS selector strings with a set of hand-written regular expressions. The shared IDENTIFIER sub-pattern also embedded in VALUE, and therefore in attribute selectors places two adjacent quantified groups over overlapping character classes: ?:classA|ESC+?:classB|ESC, where...