CVE-2026-66062 SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling for headers such as Accept uses a regular expression vulnerable to quadratic backtracking, so a maliciously...

CVE-2026-69207: Inefficient Regular Expression Complexity

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34, the built-in CORS middleware, hono/cors, is vulnerable to a regular expression denial of service ReDoS. During a preflight OPTIONS request, the middleware parses the attacker-controlled...

CVE-2026-71190

In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking ReDoS. The "qdtext" pattern ?:^"|\. allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in...

PT-2026-67961

Name of the Vulnerable Software and Affected Versions OpenStack Swift versions prior to 2.38.1 Description The proxy server Accept header parser uses a regular expression with a qdtext pattern ?:^"|. that is susceptible to catastrophic backtracking, a type of Regular Expression Denial of Service...

CVE-2026-71190: Inefficient Regular Expression Complexity

In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking ReDoS. The "qdtext" pattern ?:^"|\. allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in...

Regular Expression Denial of Service (ReDoS)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the grepknowledgefiles process. An attacker can exhaust CPU resources and prevent other users from accessing the affected worker by submitting a specially crafte...

Regular Expression Denial of Service (ReDoS)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS through the automation recurrence rule process. An attacker can cause the application to become unresponsive and deny service to all users by submitting specially...

PT-2026-67861

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.6 through 0.10.x Description The built-in knowledge search tools allow a chat participant to specify a pattern used to grep knowledge files. When patterns contain regex metacharacters, they are compiled using Python's...

Regular Expression Denial of Service (ReDoS)

Overview org.webjars.npm:hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the cors middleware during the parsing of the Access-Control-Request-Headers header via a regular expression with quadratic...

NPM: Hono: ReDoS in CORS middleware via Access-Control-Request-Headers

NPM: Hono: ReDoS in CORS middleware via Access-Control-Request-Headers vulnerability discovered by ? in WordPress Npm hono versions 4.12.34...

03-gs-ee-6 (0.3.5), @alauda-fe/dynamic-plugin-sdk-rspack (>=0.0.1-alpha.5, <=0.0.1-alpha.12) +3102 more potentially affected by CVE-2026-14257 +1 more via brace-expansion (>=4.0.0, <=5.0.8)

brace-expansion NPM version =4.0.0, =0.0.1-alpha.5, =0.0.4, =1.1.7, =1.1.8 - @angranit/fantom-virma 0.1.0 - @angranit/first-step-to-get-tea 0.1.0 - @angranit/hapeipons 1.1.2 - @angranit/nearly-vm 0.1.0 - @angranit/newme-project 0.1.0 - @angranit/npmjs-for-tea-project 0.1.0 - @angranit/phantompirs...

@algolia/coquille (>=0.0.2, <=0.0.13), @candlelabs/sdk (>=1.0.1, <=1.0.2) +28 more potentially affected by CVE-2026-69152 via brace-expansion (>=1.1.0, <=1.1.16)

brace-expansion NPM version =1.1.0, =0.0.2, =1.0.1, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =2.9.6-canary.2, =0.0.3, =0.1.0 and more Source cves: CVE-2026-69152 Source advisory: OSV:GHSA-RGW5-RVV9-X895...

CVE-2026-53504

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated numeric input, allowing a URL request to exhaust processing time. This issue is fixed in 7.8.0...

Regular Expression Denial of Service (ReDoS)

Overview apache-superset is a modern, enterprise-ready business intelligence web application. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the sqlparse.py component, specifically within the SQLREGEX used for parsing SQL statements. An attacker...

CVE-2026-23985

A Regular Expression Denial of Service ReDoS vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sqlparse.py component, specifically within the SQLREGEX used for parsing SQL statements in the sqlparse library integration. The affected regular...

CVE-2026-23985

CVE-2026-23985 is a ReDoS vulnerability in Apache Superset versions 1.5.0–5.0.0, arising from the sql_parse.py component’s integration with the sqlparse library. The issue centers on the SQL_REGEX used to parse SQL statements, where overlapping disjunctions share a common outer quantifier, enabli...

CVE-2026-23985 Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser

A Regular Expression Denial of Service ReDoS vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sqlparse.py component, specifically within the SQLREGEX used for parsing SQL statements in the sqlparse library integration. The affected regular...

CVE-2026-23985: Inefficient Regular Expression Complexity

A Regular Expression Denial of Service ReDoS vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sqlparse.py component, specifically within the SQLREGEX used for parsing SQL statements in the sqlparse library integration. The affected regular...

TencentOS Server 3: python39:3.9 and python39-devel:3.9 (TSSA-2024:1161)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:1161 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Regular Expression Denial of Service (ReDoS) in Spring Framework [CVE-2026-41848]

Summary IBM Watson Speech Services Cartridge is vulnerable to a Regular Expression Denial of Service ReDoS in Spring Framework CVE-2026-41848. Spring Framework is used as part of our microservices. This vulnerability has been addressed. Please read the details for remediation below. Vulnerability...