GHSA-6CV4-P8M7-4R25 Forge: ReDoS in forge.http response header and cookie trimming

forge.http trims response header and Set-Cookie values with the regular expression /\s$/, which takes quadratic time on a long run of whitespace followed by another character. A server or on-path attacker can block a forge.http client for minutes with one large response header. Fixed in node-forg...

npm: Forge: ReDoS in forge.http response header and cookie trimming

npm: Forge: ReDoS in forge.http response header and cookie trimming vulnerability discovered by ? in WordPress npm node-forge versions = 0.1.2, = 1.4.2...

Forge: ReDoS in forge.http response header and cookie trimming

forge.http trims response header and Set-Cookie values with the regular expression /\s$/, which takes quadratic time on a long run of whitespace followed by another character. A server or on-path attacker can block a forge.http client for minutes with one large response header. Fixed in node-forg...

CVE-2026-125333

The Forge (node-forge) JavaScript TLS implementation is vulnerable to a Regular Expression Denial of Service (ReDoS) in versions 0.1.2 through 1.4.3 . The _trimString() function in lib/http.js uses a regular expression to remove trailing whitespace from response header values and cookie names/val...

CVE-2026-125333 Forge: ReDoS in forge.http response header and cookie trimming

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. From 0.1.2 until 1.4.3, forge.http uses trimString in lib/http.js to remove trailing whitespace from response header values and cookie names and values with a regular expression that can take...

recheck

recheck The trustworthy ReDoS checker License MIT License. 2020-2026 C TSUYUSATO "MakeNowJust" Kitsune...

exploit-workshop

exploit-workshop In this step by step workshop you'll learn how to exploit various real world vulnerabilities existing in vulnerable versions of packages in a Node.js and Java application. Required software you need to install for this workshop You can do this workshop in 2 different flavours Usi...

git-vuln-finder

git-vuln-finder Finding potential software vulnerabilities from git commit messages. The output format is a JSON with the associated commit which could contain a fix regarding a software vulnerability. The search is based on a set of regular expressions against the commit messages only. If CVE ID...

regexploit

Regexploit Find regexes which are vulnerable to Regular Expression Denial of Service ReDoS. More info onthe Doyensec blog Many default regular expression parsers have unbounded worst-case complexity. Regex matching may be quick when presented with a matching input string. However, certain...

Security Bulletin: Vulnerabilities in spring-context, logback-core and Another JSON Schema Validator might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in spring-context, logback-core and Another JSON Schema Validator. Vulnerabilities include VMware Tanzu Spring Framework could provide weaker than expected security, caused by a flaw related to disallowedFields...

axios-redos

Axios Regular Expression Denial Of Service Attack This repo hold a POC of CVE-2021-3749. Overview A ReDoS regular expression denial of service flaw was found in the axios package. An attacker that is able to provide crafted input to the trim function may cause an application to consume an excessi...

CVE-2020-5236

Waitress 1.4.2 ReDoS - CVE-2020-5236 Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the...

CVE-2023-43646

CVE-2023-43646 Vulnerability Overview CVE-2023-43646 CVSS : 8.6 Sep 26, 2023 ReDoS in node.js package Part of the rebob project Vulnerability Description github advisories /\sfunction?:\s|\s/^?:/+/\s^\/+/ This vulnerability can be exploited when there is an imbalance in parentheses, which results...

CVE-2026-18535

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service ReDoS attack and to improper neutralisation of wildcard query operators...

CVE-2026-18535 IBM API Connect Denial of Service

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service ReDoS attack and to improper neutralisation of wildcard query operators...

CVE-2026-18535

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and improper neutralisation of wildcard query operators . The underlying cause is linked to inefficient regular expression complexity (CWE-1333...

EUVD-2026-118926

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service ReDoS attack and to improper neutralisation of wildcard query operators...

CVE-2024-27088

CVE-2024-27088 취약점 개요 CVE-2024-27088 Feb 26, 2024 ReDoS in node.js package rebob 프로젝트의 일환 취약점 설명 github advisories /^\sfunction\s\0-'-\uffff+\s\0--\uffff\s/ This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently...

CVE-2023-31606

CVE-2023-31606 Vulnerability A Regular Expression Denial of Service ReDoS issue was discovered in the sanitizehtml function of redcloth gem = v4.0.0. This vulnerability allows attackers to cause a Denial of Service DoS via supplying a crafted payload. What is ReDoS? As per OWASP - The Regular...

CVE-2023-27704

CVE-2023-27704 CVE-2023-27704 Void Tools Everything lower than v1.4.1.1022 was discovered to contain a Regular Expression Denial of Service ReDoS fix at Everything 1.5 alpha Suggested description Void Tools Everything lower than v1.4.1.1022 was discovered to contain a Regular Expression Denial of...