CVE-2026-53504 Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated numeric input, allowing a URL request to exhaust processing time. This issue is fixed in 7.8.0...

GHSA-FG7F-2386-8897 Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex

Summary ReviewsCorpusReader extracts feature annotations of the form label followed by a bracketed signed digit e.g. a label then +2 from each review line, using the module-level FEATURES regex. The feature-label sub-pattern is unbounded — an optional greedy run of word-plus-whitespace groups...

Regular Expression Denial of Service (ReDoS)

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the FEATURES regex in nltk/corpus/reader/reviews.py. An attacker can hang...

SUSE CVE-2026-60075

Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in parsetime. parsetime removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time...

PT-2026-66841

Name of the Vulnerable Software and Affected Versions Thumbor versions prior to 7.8.0 Description The convolution filter regular expression performs exponential backtracking when processing crafted repeated numeric input. This leads to a Regular Expression Denial of Service ReDoS, where a special...

CVE-2026-53504: Uncontrolled Resource Consumption

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated numeric input, allowing a URL request to exhaust processing time. This issue is fixed in 7.8.0...

PT-2026-66885

Name of the Vulnerable Software and Affected Versions NLTK affected versions not specified Description ReviewsCorpusReader is susceptible to a Regular Expression Denial of Service ReDoS when extracting feature annotations. The issue occurs because the FEATURES regex uses an unbounded greedy patte...

AZL-94392 CVE-2026-60075 affecting package perl-Date-Manip 6.95-3

Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in parsetime. parsetime removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time...

CVE-2026-60075

Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in parsetime. parsetime removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time...

CVE-2026-60075 Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time

Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in parsetime. parsetime removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time...

EUVD-2026-51125

Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in parsetime. parsetime removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time...

CVE-2026-60075 Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time

Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in parsetime. parsetime removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time...

CVE-2026-60075 Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time

Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in parsetime. parsetime removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time...

CVE-2026-60075

The Date::Manip Perl module (versions through 7.00 ) is vulnerable to a Denial of Service (DoS) via CPU exhaustion. The root cause is quadratic backtracking during the _parse_time function's unanchored time substitution (s/$timerx/ /). When processing an untrusted string containing long runs of i...

PT-2026-66475

Name of the Vulnerable Software and Affected Versions Date::Manip versions prior to 7.0 Description CPU exhaustion can occur due to quadratic backtracking during unanchored time substitution within the parse time function. The issue arises when the function uses an unanchored substitution...

CVE-2026-60075: Inefficient Regular Expression Complexity

Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in parsetime. parsetime removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time...

Linux Distros Unpatched Vulnerability : CVE-2026-60075

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in parsetime. parsetime removes a...

TencentOS Server 4: nodejs-nodemon (TSSA-2026:0762)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0762 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

SUSE SLES12 Security Update : perl-HTTP-Date (SUSE-SU-2026:3334-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3334-1 advisory. This update for perl-HTTP-Date fixes the following issue: - CVE-2026-14741: CPU exhaustion due to polynomial regex backtracking in parsedate when...

SUSE-SU-2026:3334-1 Security update for perl-HTTP-Date

This update for perl-HTTP-Date fixes the following issue: - CVE-2026-14741: CPU exhaustion due to polynomial regex backtracking in parsedate when processing specially crafted date strings bsc1271705...