git-vuln-finder

git-vuln-finder Finding potential software vulnerabilities from git commit messages. The output format is a JSON with the associated commit which could contain a fix regarding a software vulnerability. The search is based on a set of regular expressions against the commit messages only. If CVE ID...

CVE-2026-104454 YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an On^2 markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool...

CVE-2026-104454 YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an On^2 markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool...

recheck

recheck The trustworthy ReDoS checker License MIT License. 2020-2025 C TSUYUSATO "MakeNowJust" Kitsune...

exploit-workshop

exploit-workshop In this step by step workshop you'll learn how to exploit various real world vulnerabilities existing in vulnerable versions of packages in a Node.js and Java application. Required software you need to install for this workshop You can do this workshop in 2 different flavours Usi...

regexploit

Regexploit Find regexes which are vulnerable to Regular Expression Denial of Service ReDoS. More info onthe Doyensec blog Many default regular expression parsers have unbounded worst-case complexity. Regex matching may be quick when presented with a matching input string. However, certain...

regexploit

Regexploit Encuentra expresiones regulares vulnerables a Denegación de Servicio por Expresión Regular ReDoS. Más información enel blog de Doyensec Muchos analizadores de expresiones regulares por defecto tienen una complejidad de caso peor no acotada. La coincidencia de regex puede ser rápida...

PoC-CVE-2025-25200

CVE-2025-25200 Context Vulnerability: CVE-2025-25200 Type: Regular Expression Denial of Service ReDoS Component: Kao = 2.0.0, = 3.0.0-alpha.0, = 1.0.0, 1.7.1, 0.21.2 Description: This vulnerability presents quadratic time complexity On² or, in more critical scenarios, exponential O2ⁿ, meaning the...

CVE-2026-77387 geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point

geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.fromstring can spend excessive CPU time due to inefficient regular-expression behavior when an application passes a long malformed coordinate string without the 256-character input limit used by the fix. Geocoder rever...

CVE-2026-77387

The geopy Python geocoding library is vulnerable to a Regular Expression Denial of Service (ReDoS) in the geopy.Point and Point.from_string() functions. The root cause is inefficient regular-expression behavior when processing long malformed coordinate strings that exceed the 256-character limit ...

PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

SummaryThere is a Re-DoS vulnerability in the ispemformat function which results in a intesive CPU usage if an attacker is been able to provide a custom certificate. DetailsThe problem is that the lazy quantifier .+? will always first try to match as little as possible until it finds a ---- END...

Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)

SummaryBefore tokenizing, selectoriter trims leading/trailing whitespace and comments by running two regexes over the whole raw selector with .search. The trailing one, REWSEND = re.compiler'WSC$', is anchored only at the end $, not the start. Because .search retries the pattern at every offset, ...

Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns

Summarysoupsieve compiles CSS selector strings with a set of hand-written regular expressions. The shared IDENTIFIER sub-pattern also embedded in VALUE, and therefore in attribute selectors places two adjacent quantified groups over overlapping character classes: ?:classA|ESC+?:classB|ESC, where...

EUVD-2026-84498

jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERNFLOAT via looksLikeValidNumber...

jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()

Status FULLY REPRODUCED with a clean, textbook empirical signature: measured runtime grew almost exactly 4x for every doubling of input size across five consecutive doublings 5,000 → 160,000 characters, confirming On² behavior. A single 160,000-character string smaller than a typical HTTP request...

CVE-2024-22641

CVE-2024-22641 Vulnerability Type Regular expression Denial of Service ReDoS Affected Product and Version TCPDF AddPage; $pdf-ImageSVG$file='poc.svg'; ? Note: Checking with preglasterror after the vulnerable line of code, the regEx will exit with PREGBACKTRACKLIMITERROR...

CVE-2024-22640

CVE-2024-22640 Vulnerability Type Regular expression Denial of Service ReDoS Affected Product and Version TCPDF convertHTMLColorToDec'"t"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000!',$ref; ? Note: Checking with...

CVE-2022-45729

This repository does not have a README...

BIT-RABBITMQ-2026-67240 RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, patterntoregex maps % - .? and - ., then compiles ^...$ with only unicode; re:run is called with only capture, none - no explicit matchlimit. A pattern like %%...%X becomes ^.?..?.....?.X$ with overlapping lazy...

BIT-RABBITMQ-2026-66074 RabbitMQ: ReDoS via management API ?name= filter

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, matchvalue/3 passes the user-supplied ?name= regular expression to re:run with no matchlimit option, and executes it once per resource in the result set. OTP's default 10M matchlimit caps ea...