CVE-2026-103043

anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js...

CVE-2026-103043 anchorme through 3.0.8 Regular Expression Denial of Service

anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js...

CVE-2026-103043

The anchorme library (versions through 3.0.8 ) is vulnerable to a Regular Expression Denial of Service (ReDoS) . The issue resides in the IPv6 host extraction regex , where catastrophic backtracking can be triggered by specially crafted input strings with repeated patterns. This causes exponentia...

CVE-2026-103043 anchorme through 3.0.8 Regular Expression Denial of Service

anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js...

CVE-2026-67987

crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions in think-tag response parsing on Ruby 3.1.x. A malicious or anomalous model response containing many unterminated tags can cause excessive CPU consumption in t...

NPM: joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`

NPM: joi: Quadratic regular-expression backtracking in Joi.string.isoDate vulnerability discovered by ? in WordPress Npm joi versions = 17.2.0, 17.13.7...

joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`

Impact Any application that validates a user-supplied string with Joi.string.isoDate can be stalled by a single request. One of the regular expressions the rule runs over the input was unanchored, so a valid ISO date followed by a long run of fractional-second digits made the regex engine restart...

GHSA-6H2X-M376-MQJQ joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`

Impact Any application that validates a user-supplied string with Joi.string.isoDate can be stalled by a single request. One of the regular expressions the rule runs over the input was unanchored, so a valid ISO date followed by a long run of fractional-second digits made the regex engine restart...

BIT-GITLAB-2026-93577 Integer Overflow or Wraparound in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when...

BIT-GITLAB-2026-89078 Double Free in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a...

CLEANSTART-2026-DV63106 path-to-regexp turns path strings into a regular expressions

Security vulnerability affects the argo-workflows package. path-to-regexp turns path strings into a regular expressions...

CLEANSTART-2026-TC19011 Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (

Security vulnerability affects the argo-workflows package. Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period...

CVE-2026-103043: Inefficient Regular Expression Complexity

anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js...

PT-2026-102899

crmne/ruby llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions in think-tag response parsing on Ruby 3.1.x. A malicious or anomalous model response containing many unterminated tags can cause excessive CPU consumption in...

PT-2026-102938

Name of the Vulnerable Software and Affected Versions anchorme versions prior to 3.0.9 Description A regular expression denial of service occurs in the IPv6 host extraction regex due to catastrophic backtracking, which happens when a regex engine takes an exponential amount of time to process a...

CVE-2026-102473: Inefficient Regular Expression Complexity

A flaw was found in dash. When built without libc fnmatch, the internal pmatch matcher implements by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as .....tar.gz consume excessive CPU...

PT-2026-102734

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a...

CVE-2026-102270

A flaw was found in PyJWT. An attacker can cause a Denial of Service DoS by providing crafted certificate-like input containing repeated start markers without matching end markers. This malformed input triggers excessive regular expression backtracking during validation in the ispemformat functio...

CVE-2026-102270

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT ispemformat is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, ispemforma...

CVE-2026-102270

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT ispemformat is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, ispemforma...