follow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering

A flaw was found in follow-redirects. This vulnerability allows an untrusted remote server to receive sensitive credential headers due to improper handling of cross-origin redirects. When an application specifies sensitive headers containing special regular expression characters, the library fail...

follow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering

A flaw was found in follow-redirects. This vulnerability allows an untrusted remote server to receive sensitive credential headers due to improper handling of cross-origin redirects. When an application specifies sensitive headers containing special regular expression characters, the library fail...

CVE-2026-112366

Picomatch through 4.0.7 contains a regular expression denial of servic...

GitLab 19.5.0 Security Exposure Scanner

GitLab versions prior to the specified patched releases contain an integer overflow issue in the regular expression compiler. This tool passively fingerprints GitLab instances, identifies exposed versions, and reports their CVE-2026-110264 patch status...

CVE-2026-114603

A flaw was found in opentelemetry-api. An unauthenticated remote attacker can cause a Denial of Service DoS by sending an HTTP request with a malformed tracing header containing an excessively long sequence of whitespace characters. Because the header parsing logic uses an inefficient regular...

CVE-2026-115508

Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via...

CVE-2026-115508

Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via...

EUVD-2026-108340

Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via...

PoC-CVE-2025-25200

CVE-2025-25200 Context Vulnerability: CVE-2025-25200 Type: Regular Expression Denial of Service ReDoS Component: Kao = 2.0.0, = 3.0.0-alpha.0, = 1.0.0, 1.7.1, 0.21.2 Description: This vulnerability presents quadratic time complexity On² or, in more critical scenarios, exponential O2ⁿ, meaning the...

Exploit for CVE-2026-110264

CVE-2026-110264: GitLab Unauthenticated RCE via Onigmo Regex I...

CVE-2026-110264

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to...

CVE-2026-110264

A critical integer overflow vulnerability (CVSS 10.0) exists in GitLab CE/EE (versions 7.0 through 19.5) due to a weakness in the Onigmo regular-expression engine. An unauthenticated user could execute arbitrary code on a self-managed server by providing a specially crafted regular expression. Th...

CVE-2026-110264 Integer Overflow or Wraparound in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to...

CVE-2026-110264 Integer Overflow or Wraparound in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to...

EUVD-2026-107696

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to...

Moderate: Red Hat Security Advisory: jackson-core security update

An update for jackson-core is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

ALSA-2026:86706 Moderate: jackson-core security update

Core part of Jackson that defines Streaming API as well as basic shared abstractions. Security Fixes: com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking CVE-2026-89407 com.fasterxml.jackson.core/jackson-core:...

GitLab 7.0 < 18.11.13 / 19.0 < 19.0.10 / 19.1 < 19.1.9 / 19.2 < 19.2.9 / 19.3 < 19.3.6 / 19.4 < 19.4.3 / 19.5 < 19.5.1 (CVE-2026-110264)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and...

SUSE CVE-2026-112300

A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function sectionmarker of the file configobj/init.py. The manipulation leads to inefficient regular expression complexity. Remote exploitation of the attack is possible. The project was informed ...

SUSE CVE-2026-112366

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like + or +a, which analyzeRepeatedExtglob in lib/parse.js skips, causing exponenti...