EUVD-2026-67865

Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego.urlpattern.URLPattern.preparepatternforregex translates every asterisk in an Allow or Disallow directive into a lazy regular-expression wildcard, so a directive containing many asterisks create...

CVE-2026-55520 Protego: Exponential backtracking ReDoS in robots.txt URL wildcard matching

Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego.urlpattern.URLPattern.preparepatternforregex translates every asterisk in an Allow or Disallow directive into a lazy regular-expression wildcard, so a directive containing many asterisks create...

Security Bulletin: Vulnerabilities in spring-core-5.3.25.jar and spring-expression-6.1.11.jar (CVE-2026-41850, CVE-2026-41851, CVE-2026-41852, CVE-2026-41848) affect IBM PowerVM Novalink.

Summary The spring-core-5.3.25.jar and spring-expression-6.1.11.jar are used by IBM PowerVM Novalink. IBM PowerVM Novalink has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-41848 DESCRIPTION: Applications may be vulnerable to a Regular Expression Denial of Service ReDoS atta...

Security Bulletin: Multiple vulnerabilities in Spring Boot's Cassandra have been addressed in IBM webMethods API Management

Summary Multiple vulnerabilities in Spring Boot's Cassandra have been addressed in IBM webMethods developer portal and IBM webMethos API ControlPlane. Vulnerability Details CVEID:CVE-2026-22746 DESCRIPTION: Vulnerability in Spring Spring Security. If an application is using the...

Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Genius Hub

Summary The following dependency packages are being used by IBM Db2 Genius Hub had vulnerabilties which were resolved. - fastapi, follow-redirects, dompurify, bn.js, elliptic, form-data, js-yaml, poetry, golang.org/x/text, transformers, qs, langchain, brace-expansion, echarts, golang.org/x/sys,...

CVE-2026-81725

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the readblock method...

UBUNTU-CVE-2026-81725

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the readblock method...

CVE-2026-81725

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the readblock method...

CVE-2026-81725 NLTK before 3.10.3 Regular Expression Denial of Service via Pl196xCorpusReader

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the readblock method...

CVE-2026-81725

NLTK before 3.10.3 contains a Regular Expression Denial of Service vulnerability in the Pl196xCorpusReader component. The root cause lies in lazy regex patterns within the read_block method, which can be triggered by supplying malformed TEI blocks containing many unmatched opening tags. Attackers...

CVE-2026-81725 NLTK before 3.10.3 Regular Expression Denial of Service via Pl196xCorpusReader

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the readblock method...

CVE-2026-81725

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the readblock method...

CVE-2026-80206

A flaw was found in NLTK, specifically within its tgrep module. This vulnerability, known as Regular Expression Denial of Service ReDoS, allows a remote attacker to provide specially crafted regular expressions. When processed, these expressions can cause indefinite CPU saturation, leading to a...

CVE-2026-80205

A flaw was found in NLTK. A remote attacker can exploit a regular expression denial of service ReDoS vulnerability in the Text.findall and TokenSearcher.findall methods. These methods accept user-supplied regular expressions without validation, allowing an attacker to provide crafted patterns tha...

CVE-2026-79770

A flaw was found in Nokogiri. A remote attacker can inject specially crafted CSS selectors into methods such as Nodecss or Nodeatcss. This injection can lead to regular expression denial of service ReDoS due to exponential regex backtracking, causing the application to become unresponsive...

PT-2026-82620

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3 Description A regular expression denial of service exists in Pl196xCorpusReader. An attacker can cause quadratic CPU consumption by providing malformed TEI Text Encoding Initiative blocks containing numerous...

SUSE SLES15 Security Update : python-sqlparse (SUSE-SU-2026:3762-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3762-1 advisory. - CVE-2026-54284: TokenList.init materializes Osubtree value per group, causing CPU DoS before depth/token caps trigger bsc1275459. -...

Linux Distros Unpatched Vulnerability : CVE-2026-81725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption ...

Regular Expression Denial of Service (ReDoS)

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in TokenSearcher.findall and Text.findall in nltk/text.py. An attacker can pin a Python worker and...

Regular Expression Denial of Service (ReDoS)

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS through the tgrepnodeaction path in nltk/tgrep.py. An attacker can pin a CPU core indefinitely by...