CVE-2026-101903 Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL containing many slash characters and no...

CVE-2026-101903

The Axios HTTP client (versions 1.16.1 through 1.20.0 ) is vulnerable to a Regular Expression Denial of Service (ReDoS) . The issue stems from the RFC 2397 regular expression used in the fromDataURI function, which improperly allows slash characters on both sides of the media-type separator. An a...

CVE-2023-32309

CVE-2023-32309...

CVE-2020-5236

Waitress 1.4.2 ReDoS - CVE-2020-5236 Waitress 1.4.2 版本存在一个拒绝服务（DOS）漏洞。当 waitress 接收到包含无效字符的请求头时，会触发该漏洞。例如，收到类似 "Bad-header: xxxxxxxxxxxxxxx\x10" 的请求头，会导致正则表达式引擎灾难性回溯，使进程 CPU 占用率达到 100%，并阻塞所有其他交互。攻击者可以发送单个包含无效请求头的请求，从而将服务离线。 由 NVD 提供 使用 运行易受攻击的服务器 $ docker run --rm --name waitress -v "$PWD/src:/sr...

Security Bulletin: Threat Intelligence App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Threat Intelligence App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-33671 DESCRIPTION: Picomatch i...

CVE-2023-4220

CVE-2023-4220...

CVE-2023-31606

CVE-2023-31606 漏洞 在 redcloth gem = v4.0.0 的 sanitizehtml 函数中发现了一个正则表达式拒绝服务（ReDoS）问题。该漏洞允许攻击者通过提供精心构造的负载来引发拒绝服务（DoS）。 什么是 ReDoS？ 根据 OWASP 的说法，正则表达式拒绝服务（ReDoS）是一种拒绝服务攻击，它利用大多数正则表达式实现可能达到极端情况的事实，导致它们运行得非常缓慢（与输入大小呈指数关系）。攻击者随后可以使使用正则表达式的程序进入这些极端情况，并长时间挂起。更多信息，请参阅 OWASP ReDoS。 受影响产品 Redcloth gem = 4.0....

CVE-2023-27704

CVE-2023-27704 CVE-2023-27704 Void Tools Everything 版本低于 v1.4.1.1022 被发现包含一个正则表达式拒绝服务 ReDoS 漏洞 已在 Everything 1.5 alpha 中修复 建议描述 Void Tools Everything 版本低于 v1.4.1.1022 被发现包含一个正则表达式拒绝服务 ReDoS 漏洞。 附加信息 我将详细的复现过程放在以下链接中：...

CVE-2024-27088

CVE-2024-27088 漏洞概述 CVE-2024-27088 Feb 26, 2024 ReDoS in node.js package 作为 rebob 项目的一部分 漏洞描述 github advisories /^\sfunction\s\0-'-\uffff+\s\0--\uffff\s/ This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently increas...

CVE-2023-43646

CVE-2023-43646 漏洞概述 CVE-2023-43646 CVSS : 8.6 Sep 26, 2023 ReDoS in node.js package 作为 rebob 项目的一部分 漏洞描述 GitHub 安全公告 /\sfunction?:\s|\s/^?:/+/\s^\/+/ 当括号不平衡时，该漏洞可被利用，导致过度回溯，从而显著增加CPU负载和处理时间。可以使用以下输入触发此漏洞： '\t'.repeat54773 + '\t/function/i' 以下是一个简单的PoC代码来演示该问题： const protocolre =...

Security Bulletin: QRadar Deployment Intelligence App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. QRadar Deployment Intelligence for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-25639 DESCRIPTION: Axio...

MGASA-2026-0450 Updated python-gitpython packages fix security vulnerabilities

Denial of Service via catastrophic backtracking ReDoS in Actor.nameemailregex — commit author/committer field parsing Repository content can impersonate the git directory, leading to arbitrary code execution Residual of GHSA-hmq2-w58f-27jc: the fix validates the .gitmodules name but the sibling...

Updated python-gitpython packages fix security vulnerabilities

Denial of Service via catastrophic backtracking ReDoS in Actor.nameemailregex — commit author/committer field parsing Repository content can impersonate the git directory, leading to arbitrary code execution Residual of GHSA-hmq2-w58f-27jc: the fix validates the .gitmodules name but the sibling...

OESA-2026-4026 python-GitPython security update

GitPythonis a python library used to interact with Git repositories.GitPython provides object model read and write access to your git repository. Access repository information conveniently, alter the index directly, handle remotes, or go down to low-level object database access with big-files...

OESA-2026-4025 python-GitPython security update

GitPythonis a python library used to interact with Git repositories.GitPython provides object model read and write access to your git repository. Access repository information conveniently, alter the index directly, handle remotes, or go down to low-level object database access with big-files...

Linux Distros Unpatched Vulnerability : CVE-2026-77420

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatternsString patterns, String line in...

CVE-2026-87722

Gerrit Code Review versions 2.1.6 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 are vulnerable to Uncontrolled Resource Consumption (CWE-400 / CWE-1333). The root cause is the compilation of user-supplied regular expressions into unbounded dk.brics.automaton instances on the re...

CVE-2026-87722 Regular Expression Denial of Service (ReDoS) in Search Query Predicates and REST Filter Endpoints in Gerrit Code Review

Uncontrolled Resource Consumption CWE-400 / CWE-1333 in regex search query predicates such as RegexProjectPredicate, RegexRefPredicate, RegexPathPredicate, and sibling predicates and REST regex filter endpoints RegexListSearcher /projects/?r= and RefFilter /projects/project/branches/?r= in Gerrit...

EUVD-2026-86327

Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular expression. An authenticated caller can supply a...

CVE-2026-54461

The Habitica habit tracker application (versions 4.172.1 through 5.48.2 ) is vulnerable to a Regex Injection leading to a Regular Expression Denial of Service (ReDoS) . The flaw exists in a query parameter on the /api/v3/groups/:groupId/members route, where input is not sanitized before being int...