Regular Expression Denial of Service (ReDoS)

Overview bleach is a whitlist-based HTML sanitizing library that escapes or strips markup and attributes. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the LinkifyFilter.handleemailaddresses function. An attacker can cause excessive CPU...

PT-2026-52868

Summary Bleach 6.3.0 exposes a documented email-linkification path through bleach.linkify..., parse email=True. The implementation scans attacker-controlled text with EMAIL RE.finditer over the full character token and has no length, timeout, or linear prefilter before applying the dot-atom email...