CVE-2026-102473

A vulnerability exists in dash where the internal pmatch() matcher implements the * wildcard using unbounded recursion over candidate positions when built without libc fnmatch . A local user capable of providing filenames to the matcher can trigger super-polynomial backtracking by using short mul...

EUVD-2026-45190

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parsedate. parsedate matches the date string against a chain of alternative regexes, and str2time delegates to it. Several of these patterns place unbounded quantifiers next to each other before a...

CVE-2026-14741: Inefficient Regular Expression Complexity

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parsedate. parsedate matches the date string against a chain of alternative regexes, and str2time delegates to it. Several of these patterns place unbounded quantifiers next to each other before a...

fastapi-guard is vulnerable to ReDoS through inefficient regex

Summaryfastapi-guard detects penetration attempts by using regex patterns to scan incoming requests. However, some of the regex patterns used in detection are extremely inefficient and can cause polynomial complexity backtracks when handling specially crafted inputs.It is not as severe as...

CVE-2026-47138: Inefficient Regular Expression Complexity

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.77 and 9.9.1-alpha.1, an unauthenticated attacker who knows a publicly-known Parse Application ID can submit a single HTTP request whose client SDK version field contains...

Regular Expression Denial Of Service (ReDoS)

shescape is vulnerable to regular expression denial of service. The vulnerability exists in escapeArgBash function in unix.js due to insufficient regular expression complexity in bash escaping which allows an attacker to cause polynomial backtracking or quadratic runtime resulting an application...

CVE-2022-36064: Inefficient Regular Expression Complexity

Shescape is a shell escape package for JavaScript. An Inefficient Regular Expression Complexity vulnerability impacts users that use Shescape to escape arguments for the Unix shells Bash and Dash, or any not-officially-supported Unix shell; and/or using the escape or escapeAll functions with the...