Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2021_3073)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20213073 advisory. nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl CVE-2021-23362 nodejs-ssri: Regular expression DoS ReDoS when...

EUVD-2026-74845

GitPython: Denial of Service via catastrophic backtracking ReDoS in Actor.nameemailregex — commit author/committer field parsing...

GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing

Summary GitPython's Actor.nameemailregex regular expression git/util.py, line 863 is vulnerable to catastrophic backtracking ReDoS — Regular Expression Denial of Service. When GitPython parses the author or committer header of a git commit object that contains a long string with an unterminated ,...

Security Bulletin: Vulnerabilities in Netty,node.js,spring-cloud-gateway-server,Angular,Picomatch,nanoid,spring-security,form-data,Apache Log4j Core,brace-expansion might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Netty,node.js,spring-cloud-gateway server,Angular,Picomatch,nanoid,spring-security,form-data,Apache Log4j Core,brace-expansion. Vulnerabilities include the tmp npm package contains a path traversal vulnerabili...

CVE-2026-100267

In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters...

EUVD-2026-90011

In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters...

CVE-2026-100267

JetBrains YouTrack versions prior to 2026.2.19197 are vulnerable to a Regular Expression Denial of Service (reDoS) attack. The vulnerability exists in the mailbox regex mail-rule filters , where a specially crafted regex can cause significant resource exhaustion. The impact is a high availability...

CVE-2026-100267

In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters...

Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

Summary Axios for Node.js parses data: URLs in lib/helpers/fromDataURI.js. The current RFC-2397 parser uses a regular expression whose media type groups allow / inside both sides of the type/subtype match. A malformed data: URL containing many slashes and no comma forces the JavaScript regex engi...

NPM: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

NPM: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop DoS vulnerability discovered by ? in WordPress Npm axios versions = 1.16.1, 1.20.0...

GHSA-C29M-XWM3-CM6R Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

Summary Axios for Node.js parses data: URLs in lib/helpers/fromDataURI.js. The current RFC-2397 parser uses a regular expression whose media type groups allow / inside both sides of the type/subtype match. A malformed data: URL containing many slashes and no comma forces the JavaScript regex engi...

Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

Summary Axios shouldBypassProxy normalizes hostnames with hostname.replace/.+$/, ''. For a hostname shaped as many dots followed by a non-dot, the anchored regex can perform quadratic backtracking. Because axios re-evaluates proxy bypass rules for redirected requests, a malicious server can...

GHSA-MGHH-PGCX-3JJJ Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

Summary Axios shouldBypassProxy normalizes hostnames with hostname.replace/.+$/, ''. For a hostname shaped as many dots followed by a non-dot, the anchored regex can perform quadratic backtracking. Because axios re-evaluates proxy bypass rules for redirected requests, a malicious server can...

NPM: Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

NPM: Axios: ReDoS ON² in shouldBypassProxy host normalization, reachable via untrusted redirect Location vulnerability discovered by ? in WordPress Npm axios versions = 1.15.0, 1.20.0...

GHSA-JWRC-G2Q2-PQ5P PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

Summary There is a Re-DoS vulnerability in the ispemformat function which results in a intesive CPU usage if an attacker is been able to provide a custom certificate. Details The problem is that the lazy quantifier .+? will always first try to match as little as possible until it finds a ---- END...

PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

Summary There is a Re-DoS vulnerability in the ispemformat function which results in a intesive CPU usage if an attacker is been able to provide a custom certificate. Details The problem is that the lazy quantifier .+? will always first try to match as little as possible until it finds a ---- END...

AlmaLinux 9.2 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc (ALMALINUX9.2:CLSA-2025:1755617966)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1755617966 advisory. - A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific...

AlmaLinux 9.2 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc (ALMALINUX9.2:CLSA-2026:1779099998)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779099998 advisory. - A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have...

AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1777394614)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1777394614 advisory. - Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service ReDoS via the function new Rang...

axios-redos

Ataque de Denegación de Servicio por Expresión Regular en Axios Este repositorio contiene un POC de CVE-2021-3749. Resumen Se encontró una falla de ReDoS denegación de servicio por expresión regular en el paquete axios. Un atacante que pueda proporcionar una entrada manipulada a la función trim...