Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via ispemformat in jwt/utils.py, which previously used a regex PEMRE that accepted PEM formatting variants recognised by the underlying cryptography loader but not explicitly validated by pyjwt...

CVE-2026-102270

The PyJWT library (prior to version 2.14.0 ) is vulnerable to a Regular Expression Denial of Service (ReDoS) in the is_pem_format function. The root cause is extensive backtracking performed by a lazy PEM regular expression when processing certificate-like inputs containing repeated BEGIN markers...

CVE-2026-102270 PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT ispemformat is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, ispemforma...

CVE-2026-102270 PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT ispemformat is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, ispemforma...

CVE-2026-102270 PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT ispemformat is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, ispemforma...

Regular Expression Denial of Service (ReDoS)

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via improper validation of runtime options in resolveConfig and related helpers, where an attacker-controlled or malformed...

Regular Expression Denial of Service (ReDoS)

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via improper validation of runtime options in resolveConfig and related helpers, where an attacker-controlled o...

CVE-2026-101906

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTPPROXY or HTTPSPROXY is configured, NOPROXY or noproxy is non-empty, redirects are followed, and a...

UBUNTU-CVE-2026-101903

Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL containing many slash characters and no...

CVE-2026-101906 Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTPPROXY or HTTPSPROXY is configured, NOPROXY or noproxy is non-empty, redirects are followed, and a...

CVE-2026-101906 Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTPPROXY or HTTPSPROXY is configured, NOPROXY or noproxy is non-empty, redirects are followed, and a...

CVE-2026-101906

The Axios promise-based HTTP client is vulnerable to a Regular Expression Denial of Service (ReDoS) affecting versions 1.15.0 through 1.20.0 . The root cause is a quadratic trailing-dot regular expression used within the shouldBypassProxy function during host normalization. When HTTP_PROXY/HTTPS_...

CVE-2026-101906 Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTPPROXY or HTTPSPROXY is configured, NOPROXY or noproxy is non-empty, redirects are followed, and a...

CVE-2026-101903 Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL containing many slash characters and no...

CVE-2026-101903 Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL containing many slash characters and no...

CVE-2026-101903

The Axios HTTP client (versions 1.16.1 through 1.20.0 ) is vulnerable to a Regular Expression Denial of Service (ReDoS) . The issue stems from the RFC 2397 regular expression used in the fromDataURI function, which improperly allows slash characters on both sides of the media-type separator. An a...

CVE-2026-101903 Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL containing many slash characters and no...

Security Bulletin: Threat Intelligence App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Threat Intelligence App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-33671 DESCRIPTION: Picomatch i...

Security Bulletin: QRadar Deployment Intelligence App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. QRadar Deployment Intelligence for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-25639 DESCRIPTION: Axio...

MGASA-2026-0450 Updated python-gitpython packages fix security vulnerabilities

Denial of Service via catastrophic backtracking ReDoS in Actor.nameemailregex — commit author/committer field parsing Repository content can impersonate the git directory, leading to arbitrary code execution Residual of GHSA-hmq2-w58f-27jc: the fix validates the .gitmodules name but the sibling...