regexploit

Regexploit Find regexes which are vulnerable to Regular Expression Denial of Service ReDoS. More info onthe Doyensec blog Many default regular expression parsers have unbounded worst-case complexity. Regex matching may be quick when presented with a matching input string. However, certain...

regexploit

Regexploit 寻找易受正则表达式拒绝服务（ReDoS）攻击的正则表达式。 更多信息请参见Doyensec 博客 许多默认的正则表达式解析器具有无界的最坏情况复杂度。当输入字符串匹配时，正则表达式匹配可能很快。然而，某些不匹配的输入字符串会使正则表达式匹配器陷入疯狂的回溯循环，并花费大量时间处理。这可能导致拒绝服务，因为CPU将被卡住尝试匹配正则表达式。 该工具旨在： 查找易受ReDoS攻击的正则表达式 给出一个会导致灾难性回溯的恶意字符串示例 最坏情况复杂度 这反映了正则表达式匹配器回溯过程的复杂度与输入字符串长度的关系。...

exploit-workshop

exploit-workshop En este taller paso a paso aprenderás cómo explotar varias vulnerabilidades del mundo real que existen en versiones vulnerables de paquetes en una aplicación Node.js y Java. Software necesario que debes instalar para este taller Puedes realizar este taller de 2 formas diferentes...

recheck

recheck 可信赖的 ReDoS 检查器 许可证 MIT 许可证。 2020-2025 C TSUYUSATO "MakeNowJust" Kitsune...

CVE-2026-87722

Gerrit Code Review versions 2.1.6 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 are vulnerable to Uncontrolled Resource Consumption (CWE-400 / CWE-1333). The root cause is the compilation of user-supplied regular expressions into unbounded dk.brics.automaton instances on the re...

PoC-CVE-2025-25200

CVE-2025-25200 Contexto Vulnerabilidad: CVE-2025-25200 Tipo: Regular Expression Denial of Service ReDoS Componente: Kao = 2.0.0, = 3.0.0-alpha.0, = 1.0.0, 1.7.1, 0.21.2 Descripción: Esta vulnerabilidad presenta complejidad de tiempo cuadrática On2 o, en escenarios más críticos, exponencial O2n, e...

CVE-2026-54461

The Habitica habit tracker application (versions 4.172.1 through 5.48.2 ) is vulnerable to a Regex Injection leading to a Regular Expression Denial of Service (ReDoS) . The flaw exists in a query parameter on the /api/v3/groups/:groupId/members route, where input is not sanitized before being int...

CVE-2024-22641

CVE-2024-22641 Tipo de Vulnerabilidad Denegación de Servicio por Expresión Regular ReDoS Producto y Versión Afectados TCPDF root@kitploit: AddPage; $pdf-ImageSVG$file='poc.svg'; ?...

CVE-2024-22640

CVE-2024-22640 Tipo de vulnerabilidad Denegación de servicio por expresión regular ReDoS Producto y versión afectados TCPDF convertHTMLColorToDec'"t"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000!',$ref; ? Nota: Al...

CVE-2022-45729

Este repositorio no tiene un README...

git-vuln-finder

git-vuln-finder Finding potential software vulnerabilities from git commit messages. The output format is a JSON with the associated commit which could contain a fix regarding a software vulnerability. The search is based on a set of regular expressions against the commit messages only. If CVE ID...

CVE-2026-67240

A flaw was found in RabbitMQ, a messaging and streaming broker. An authenticated AMQP 1.0 consumer with read and write permissions on a stream queue can exploit a Regular Expression Denial of Service ReDoS vulnerability. This occurs when a crafted LIKE filter is processed, leading to excessive CP...

vue-template-compiler-patched

vue-template-compiler-patched A security-patched version of vue-template-compiler to fix the prototype pollution vulnerability CVE-2024-6783 and the ReDoS vulnerability CVE-2024-9506. Based on [email protected]. Development and issues live in vue-patched. Related If you use the Vue full buil...

CVE-2026-66074

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, matchvalue/3 passes the user-supplied ?name= regular expression to re:run with no matchlimit option, and executes it once per resource in the result set. OTP's default 10M matchlimit caps ea...

CVE-2026-66074

A flaw was found in RabbitMQ. A remote attacker with management privileges could exploit a regular expression regex filter in the management API by providing a specially crafted regex to the ?name= filter. This vulnerability, known as Regular Expression Denial of Service ReDoS, causes excessive C...

CVE-2026-66074

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, matchvalue/3 passes the user-supplied ?name= regular expression to re:run with no matchlimit option, and executes it once per resource in the result set. OTP's default 10M matchlimit caps ea...

CVE-2026-66074 RabbitMQ: ReDoS via management API ?name= filter

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, matchvalue/3 passes the user-supplied ?name= regular expression to re:run with no matchlimit option, and executes it once per resource in the result set. OTP's default 10M matchlimit caps ea...

CVE-2026-66074 RabbitMQ: ReDoS via management API ?name= filter

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, matchvalue/3 passes the user-supplied ?name= regular expression to re:run with no matchlimit option, and executes it once per resource in the result set. OTP's default 10M matchlimit caps ea...

CVE-2026-67240 RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, patterntoregex maps % - .? and - ., then compiles ^...$ with only unicode; re:run is called with only capture, none - no explicit matchlimit. A pattern like %%...%X becomes ^.?..?.....?.X$ with overlapping lazy...

CVE-2026-67240 RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, patterntoregex maps % - .? and - ., then compiles ^...$ with only unicode; re:run is called with only capture, none - no explicit matchlimit. A pattern like %%...%X becomes ^.?..?.....?.X$ with overlapping lazy...