4419 matches found
CVE-2024-6839 Improper Regex Path Matching in corydolphin/flask-cors
corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex...
CVE-2024-6839 Improper Regex Path Matching in corydolphin/flask-cors
corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex...
CVE-2024-6839
corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex...
CVE-2024-6839
CVE-2024-6839 is a confirmed issue in corydolphin/flask-cors 4.0.1 where improper regex path matching lets less restrictive CORS policies apply to sensitive endpoints due to priority bias toward longer regexes. The vulnerability can enable unauthorized cross-origin access to data or functionality...
CVE-2024-6839 Improper Regex Path Matching in corydolphin/flask-cors
corydolphin/flask-cors version 4.0.1 contains an improper regex path matching vulnerability. The plugin prioritizes longer regex patterns over more specific ones when matching paths, which can lead to less restrictive CORS policies being applied to sensitive endpoints. This mismatch in regex...
CVE-2024-8764 Improper Authorization in lunary-ai/lunary
A vulnerability in lunary-ai/lunary, as of commit be54057, allows users to upload and execute arbitrary regular expressions on the server side. This can lead to a Denial of Service DoS condition, as certain regular expressions can cause excessive resource consumption, blocking the server from...
Lunary 资源管理错误漏洞
Lunary is Lunary open source a production toolkit for LLM . A security vulnerability exists in Lunary version 105a3f6 that originates from allowing users to upload and execute arbitrary regular expressions, which can be exploited by an attacker to potentially cause a regular expression denial of...
Danswer 资源管理错误漏洞
Danswer is Danswer AI open source an artificial intelligence assistant that connects to company documents, applications and people. Danswer suffers from a Resource Management Error vulnerability that stems from a regular expression denial of service, which could result in significantly slower...
PT-2025-12257 · Lunary Ai · Lunary
Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version git f07a845 lunary-ai/lunary versions prior to 1.4.26 Description: A Regular Expression Denial of Service ReDoS vulnerability exists in the server, which uses the regex /.?/ to match user-controlled strings. In the...
Flask-CORS 安全漏洞
Flask-CORS is a cross-origin resource sharing component for Flask by the individual developer Cory Dolphin. A security vulnerability exists in Flask-CORS version 4.0.1, which stems from improperly matched regular expression paths and could lead to improperly applied cross-domain resource sharing...
CVE-2025-26042
Uptime Kuma == 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. If a string is provided it triggers catastrophic backtracking in the regular expression, leading to a ReDoS attack...
CVE-2025-27789
Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the .replace method that has quadratic complexity on some specific replacement...
CVE-2025-27789
CVE-2025-27789 affects Babel: prior to 7.26.10 and 8.0.0-alpha.17, compiling regex with named capturing groups can cause Babel to generate a .replace polyfill with quadratic complexity on certain replacement patterns. The issue requires that code uses untrusted strings as the second argument to ....
PT-2025-10894
Name of the Vulnerable Software and Affected Versions: Babel versions prior to 7.26.10 Babel versions prior to 8.0.0-alpha.17 Description: The issue arises when using Babel to compile regular expression named capturing groups and the .replace method on a regular expression that contains named...
PT-2025-28150
Name of the Vulnerable Software and Affected Versions: huggingface/transformers version 4.49.0 Description: A Regular Expression Denial of Service ReDoS vulnerability was discovered in the huggingface/transformers repository. The vulnerability is due to inefficient regular expression complexity i...
Linux Distros Unpatched Vulnerability : CVE-2022-41715
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation ...
Linux Distros Unpatched Vulnerability : CVE-2022-24713
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caus...
Linux Distros Unpatched Vulnerability : CVE-2021-3807
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ansi-regex is vulnerable to Inefficient Regular Expression Complexity CVE-2021-3807 Note that Nessus relies on the presence of the package as reported by the...
Linux Distros Unpatched Vulnerability : CVE-2015-2305
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library aka rxspencer alpha3.8.g5 on 32-bit platforms, as used in NetBSD through...