CVE-2026-71848

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the languageDetector middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen separated subtags. To...

CVE-2026-71848 Hono: Algorithmic Complexity DoS in Language Middleware

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the languageDetector middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen separated subtags. To...

EUVD-2026-54578

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to 4.12.33, the languageDetector middleware is vulnerable to algorithmic complexity denial of service when processing a crafted language tag containing a large number of hyphen separated subtags. To...

CVE-2026-66062

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling for headers such as Accept uses a regular expression vulnerable to quadratic backtracking, so a maliciously...

Quadratic Behavior in xml.etree.ElementPath Index Predicates

...

Linux Distros Unpatched Vulnerability : CVE-2026-71488

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser ...

CVE-2026-71488

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translat...

CVE-2026-71488

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translat...

DEBIAN-CVE-2026-71430

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's...

CVE-2026-71488 league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translat...

EUVD-2026-54143

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translat...

CVE-2026-71488

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translat...

CVE-2026-71488 league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translat...

CVE-2026-71488

The CVE concerns league/commonmark (PHP) with a vulnerability in versions 0.6.0–2.9.0 where crafted Markdown can trigger quadratic-time processing during parsing/conversion. The root cause involves repeatedly rescanning growing segments to translate character positions to byte positions, and the ...

GHSA-5P4M-2WFM-XMQJ JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

Quadratic CPU consumption in !!omap resolution js-yaml 3.x and 4.x Summary resolveYamlOmap enforces key uniqueness for !!omap sequences with a linear scan objectKeys.indexOf... inside the per-element loop, making resolution On² in the number of entries. A modestly sized YAML document therefore...

CVE-2026-68750

Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene htmlsanitizeex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of HtmlSanitizeEx.Traverser.traverse/2 recurses on the...

CVE-2026-68750

CVE-2026-68750 affects the html_sanitize_ex crate (versions 0.3.1 up to, but not including, 1.5.3). The vulnerability is a quadratic-time CPU/memory exhaustion in the HTML traversal engine when sanitizing large sibling lists; the traverser recurses on the tail and repeatedly flattens lists, causi...

CVE-2026-68750 Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service

Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene htmlsanitizeex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of HtmlSanitizeEx.Traverser.traverse/2 recurses on the...

EUVD-2026-54085

Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene htmlsanitizeex allows an unauthenticated remote attacker to exhaust server CPU and memory via a flat run of sibling elements in sanitized HTML. The list clause of HtmlSanitizeEx.Traverser.traverse/2 recurses on the...

EUVD-2026-54084

Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name...