opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

Summary OpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted tracestate headers, potentially leading to denial of service. Regex backtracking causes quadratic parsing time for headers containing long runs of spaces or tabs without a following...

GHSA-CCRJ-GW8R-854M opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

Summary OpenTelemetry Java's W3C trace-context propagator permits excessive CPU consumption when extracting crafted tracestate headers, potentially leading to denial of service. Regex backtracking causes quadratic parsing time for headers containing long runs of spaces or tabs without a following...

CVE-2026-117500

HTTP::Body versions before 1.2401 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basenameregexp, qr/^.+.^\/+$/, against the whole basename. A...

CVE-2026-116285

HTTP::Body versions before 1.2301 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In chunked mode, used when no content length is given, add matches each chunk-size line with /^\da-fA-F+.\x0D\x0A/. On a line of hex digits whose first LF has no C...

CVE-2026-117500 HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload

HTTP::Body versions before 1.2401 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basenameregexp, qr/^.+.^\/+$/, against the whole basename. A...

EUVD-2026-112276

HTTP::Body versions before 1.2401 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basenameregexp, qr/^.+.^\/+$/, against the whole basename. A...

CVE-2026-117500

The HTTP::Body Perl module (versions before 1.24_01 ) is vulnerable to CPU exhaustion due to regex backtracking during multipart upload processing. The multipart parser uses a regular expression (qr/[^.]+( erm./[^\/]+)$/) to identify the suffix of uploaded filenames. A specially crafted basename ...

CVE-2026-116285

The HTTP::Body Perl module (versions before 1.23_01 ) is vulnerable to CPU exhaustion due to quadratic regex backtracking. When parsing chunked request bodies , the add() function matches chunk-size lines using the regex /^([ a-fA-F]+).* /. If a line of hex digits is provided where the first line...

EUVD-2026-112274

HTTP::Body versions before 1.2301 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In chunked mode, used when no content length is given, add matches each chunk-size line with /^\da-fA-F+.\x0D\x0A/. On a line of hex digits whose first LF has no C...

CVE-2026-116285

HTTP::Body versions before 1.2301 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In chunked mode, used when no content length is given, add matches each chunk-size line with /^\da-fA-F+.\x0D\x0A/. On a line of hex digits whose first LF has no C...

CVE-2026-116285 HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies

HTTP::Body versions before 1.2301 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In chunked mode, used when no content length is given, add matches each chunk-size line with /^\da-fA-F+.\x0D\x0A/. On a line of hex digits whose first LF has no C...

PT-2026-128347

HTTP::Body versions before 1.24 01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basename regexp, qr/^.+.^/+$/, against the whole basename. A...

PT-2026-128342

HTTP::Body versions before 1.23 01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In chunked mode, used when no content length is given, add matches each chunk-size line with /^da-fA-F+.x0Dx0A/. On a line of hex digits whose first LF has no CR...

CVE-2023-43646

CVE-2023-43646 Vulnerability Overview CVE-2023-43646 CVSS : 8.6 Sep 26, 2023 ReDoS in node.js package Part of the rebob project Vulnerability Description github advisories /\sfunction?:\s|\s/^?:/+/\s^\/+/ This vulnerability can be exploited when there is an imbalance in parentheses, which results...

CVE-2024-27088

CVE-2024-27088 취약점 개요 CVE-2024-27088 Feb 26, 2024 ReDoS in node.js package rebob 프로젝트의 일환 취약점 설명 github advisories /^\sfunction\s\0-'-\uffff+\s\0--\uffff\s/ This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently...

Security Bulletin: IBM Maximo Application Suite uses jackson-core-2.18.10.jar which is vulnerable to CVE-2026-89407, CVE-2026-89425.

Summary IBM Maximo Application Suite uses jackson-core-2.18.10.jar which is vulnerable to CVE-2026-89407, CVE-2026-89425. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-89407 DESCRIPTION: NumberInput.looksLikeValidNumber in...

Security Bulletin:Multiple vulnerabilities in jackson-core may affect IBM Infosphere Change Data Capture (CVE-2026-89407, CVE-2026-89425)

Summary Multiple security vulnerabilities have been identified in jackson-core, Core Jackson processing abstractions. jackson-core is used by IBM Infosphere Change Data Capture. IBM has addressed these vulnerabilities. Refer to the "Remediation/Fixes" section below for remediation details...

SUSE CVE-2026-115822

Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked request bodies before calling the application, matching each chunk-size line with s/^0-9a-fA-F+.\015\012//. A line of hex digits followed by a...

UBUNTU-CVE-2026-115822

Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked request bodies before calling the application, matching each chunk-size line with s/^0-9a-fA-F+.\015\012//. A line of hex digits followed by a...

Linux Distros Unpatched Vulnerability : CVE-2026-115822

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked reque...