npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser

websocket-extensions npm module prior to 0.1.4 allows Denial of Service DoS via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other...

GitHub Security Lab: CodeQL query for finding ReDoS and Regex Injection vulnerabilities in Java

This bug was reported directly to GitHub Security Lab...

PT-2020-6268 · Python +9 · Python +9

Name of the Vulnerable Software and Affected Versions: Python versions 2.7 through 2.7.17 Python versions 3.5 through 3.5.9 Python versions 3.6 through 3.6.10 Python versions 3.7 through 3.7.6 Python versions 3.8 through 3.8.1 Description: The issue is related to an uncontrolled consumption of...

Regular Expression Denial Of Service (ReDoS)

diff is vulnerable to regular expression denial of service ReDoS. The vulnerability exists due to improper use of regular expression to parse data from the fileHeader parameter in parseFileHeader, allowing an attacker to cause a denial of service condition by submitting a malicious file header...

CVE-2019-12041

lib/common/htmlre.js in remarkable 1.7.1 allows Regular Expression Denial of Service ReDoS via a CDATA section...

UBUNTU-CVE-2019-11390

DISPUTED An issue was discovered in OWASP ModSecurity Core Rule Set CRS through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause a denial of service ReDOS by entering a specially crafted string with seterrorhandler at the beginning and nested repetition...

CVE-2018-20164

An issue was discovered in regex.yaml aka regexes.yaml in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service ReDoS issue allows remote attackers to overload a server by setting the User-Agent header in an HTTPS request to a value containing a long digit string. The UAP-Core...

GHSA-8462-Q7X7-G2X4 js-bson vulnerable to REDoS

The MongoDB bson JavaScript module also known as js-bson versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service ReDoS in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString function is called to parse a long untrusted string...

Regular Expression Denial Of Service (ReDoS)

charset is vulnerable to regular expression denial of service ReDoS attacks. A malicious user can pass a string to the through the HTTP header to cause a ReDoS attack...

CVE-2018-3738

protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files...

DEBIAN-CVE-2016-10539

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string...

Moderate severity vulnerability that affects marked

Withdrawn This advisory has been withdrawn, per NVD: "This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue." Original Description A Regular expression Denial of Service ReDoS vulnerability in the file marked.js of the marked npm package tested on...

Input validation

Blocks/Common/Src/Configuration/Manageability/Adm/AdmContentBuilder.cs in Microsoft patterns & practices Enterprise Library aka EntLib allows context-dependent attackers to cause a denial of service CPU consumption via an input string composed of many \ backslash characters followed by a " double...

CVE-2009-3275

Blocks/Common/Src/Configuration/Manageability/Adm/AdmContentBuilder.cs in Microsoft patterns & practices Enterprise Library aka EntLib allows context-dependent attackers to cause a denial of service CPU consumption via an input string composed of many \ backslash characters followed by a " double...

CVE-2009-3275

Blocks/Common/Src/Configuration/Manageability/Adm/AdmContentBuilder.cs in Microsoft patterns & practices Enterprise Library aka EntLib allows context-dependent attackers to cause a denial of service CPU consumption via an input string composed of many \ backslash characters followed by a " double...

CVE-2009-3276

CVE-2009-3276 affects Zoran/WinFormsAdvansed/RegeularDataToXML/Form1.cs in WinFormsAdvansed within NASD CORE.NET Terelik (aka corenet1). The vulnerability is a ReDoS: context-dependent attackers can cause CPU exhaustion by supplying an input string consisting of many alphabetic characters followe...