CVE-2026-126191

The Soup Sieve CSS selector library, used with Beautiful Soup 4 , is vulnerable to exponential regular-expression backtracking in versions prior to 3.0 . The vulnerability exists because the CSS_ESCAPES and IDENTIFIER subpatterns can backtrack exponentially when processing ambiguous digit escapes...

CVE-2023-43646

CVE-2023-43646 Vulnerability Overview CVE-2023-43646 CVSS : 8.6 Sep 26, 2023 ReDoS in node.js package Part of the rebob project Vulnerability Description github advisories /\sfunction?:\s|\s/^?:/+/\s^\/+/ This vulnerability can be exploited when there is an imbalance in parentheses, which results...

RHLW-2026-7DCB1A44E2EDEB0E Lightwell Security Advisory: jackson-core 2.17.3.rhlw-00005

Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-core 2.17.3.rhlw-00005 with backported fixes for CVE-2026-18401, CVE-2026-68494, CVE-2026-89407, and CVE-2026-89425. CVE-2026-18401: jackson-core: Number length constraint bypass in non-blocking async JSON parser leads to potential...

recheck

recheck The trustworthy ReDoS checker License MIT License. 2020-2026 C TSUYUSATO "MakeNowJust" Kitsune...

git-vuln-finder

git-vuln-finder Finding potential software vulnerabilities from git commit messages. The output format is a JSON with the associated commit which could contain a fix regarding a software vulnerability. The search is based on a set of regular expressions against the commit messages only. If CVE ID...

CVE-2022-45729

This repository does not have a README...

exploit-workshop

exploit-workshop In this step by step workshop you'll learn how to exploit various real world vulnerabilities existing in vulnerable versions of packages in a Node.js and Java application. Required software you need to install for this workshop You can do this workshop in 2 different flavours Usi...

regexploit

Regexploit Find regexes which are vulnerable to Regular Expression Denial of Service ReDoS. More info onthe Doyensec blog Many default regular expression parsers have unbounded worst-case complexity. Regex matching may be quick when presented with a matching input string. However, certain...

CVE-2024-27088

CVE-2024-27088 취약점 개요 CVE-2024-27088 Feb 26, 2024 ReDoS in node.js package rebob 프로젝트의 일환 취약점 설명 github advisories /^\sfunction\s\0-'-\uffff+\s\0--\uffff\s/ This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently...

CVE-2023-31606

CVE-2023-31606 Vulnerability A Regular Expression Denial of Service ReDoS issue was discovered in the sanitizehtml function of redcloth gem = v4.0.0. This vulnerability allows attackers to cause a Denial of Service DoS via supplying a crafted payload. What is ReDoS? As per OWASP - The Regular...

Security update for python-Twisted

This update for python-Twisted fixes the following issues: CVE-2026-83813: DNS spoofing in twisted.names due to missing source address validation bsc1287833. CVE-2026-106454: ReDoS due to improper use of re.compile in wildcardToRegexp bsc1284420. CVE-2026-115774: denial of service via negative si...

CVE-2026-61619

The OWASP core rule set CRS is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, regular-expression denial of service ReDoS affects a shared regex-assembly include used to build 12 Unix RCE detection rules in C...

EUVD-2026-123632

The OWASP core rule set CRS is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, regular-expression denial of service ReDoS affects a shared regex-assembly include used to build 12 Unix RCE detection rules in C...

CVE-2026-61619

The OWASP core rule set CRS is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, regular-expression denial of service ReDoS affects a shared regex-assembly include used to build 12 Unix RCE detection rules in C...

CVE-2026-61619 OWASP CRS: ReDoS in shared unix-shell-evasion regex-assembly include (12 RCE rules) - PCRE2 backtracking-limit exhaustion causes detection bypass and CPU DoS

The OWASP core rule set CRS is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, regular-expression denial of service ReDoS affects a shared regex-assembly include used to build 12 Unix RCE detection rules in C...

CVE-2026-61619

The OWASP core rule set (CRS) is vulnerable to a Regular-expression Denial of Service (ReDoS) affecting versions prior to 3.3.10, 4.25.1, and 4.28.0 . The root cause is an ambiguous pattern in a shared regex-assembly include used for Unix RCE detection rules (specifically 12 rules in CRS v4 and 4...

com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking

A flaw was found in jackson-core. An attacker can supply specially crafted JSON that, when deserialized into a numeric target type, triggers a Regular expression Denial of Service ReDoS vulnerability. This occurs due to quadratic backtracking in the NumberInput.looksLikeValidNumber method's...

com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking

A flaw was found in jackson-core. An attacker can supply specially crafted JSON that, when deserialized into a numeric target type, triggers a Regular expression Denial of Service ReDoS vulnerability. This occurs due to quadratic backtracking in the NumberInput.looksLikeValidNumber method's...

CVE-2024-22641

CVE-2024-22641 Vulnerability Type Regular expression Denial of Service ReDoS Affected Product and Version TCPDF AddPage; $pdf-ImageSVG$file='poc.svg'; ? Note: Checking with preglasterror after the vulnerable line of code, the regEx will exit with PREGBACKTRACKLIMITERROR...

com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking

A flaw was found in jackson-core. An attacker can supply specially crafted JSON that, when deserialized into a numeric target type, triggers a Regular expression Denial of Service ReDoS vulnerability. This occurs due to quadratic backtracking in the NumberInput.looksLikeValidNumber method's...