Linux Distros Unpatched Vulnerability : CVE-2026-82617

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULTREGEXNAMEFINDER.EMAIL and DEFAULTREGEXNAMEFINDER.URL -...

DEBIAN-CVE-2026-82617

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULTREGEXNAMEFINDER.EMAIL and DEFAULTREGEXNAMEFINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders...

CVE-2026-82617

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULTREGEXNAMEFINDER.EMAIL and DEFAULTREGEXNAMEFINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders...

UBUNTU-CVE-2026-82617

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULTREGEXNAMEFINDER.EMAIL and DEFAULTREGEXNAMEFINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders...

CVE-2026-82617

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULTREGEXNAMEFINDER.EMAIL and DEFAULTREGEXNAMEFINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders...

CVE-2026-82617 Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULTREGEXNAMEFINDER.EMAIL and DEFAULTREGEXNAMEFINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders...

EUVD-2026-76169

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULTREGEXNAMEFINDER.EMAIL and DEFAULTREGEXNAMEFINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders...

CVE-2026-82617

Apache OpenNLP versions 2.0.0 through 2.5.11 and 3.0.0-M1 through 3.0.0-M5 are affected by ambiguous nested quantifiers in the built-in EMAIL and URL name-finder patterns of RegexNameFinderFactory. The EMAIL pattern suffers quadratic-time ReDoS: a ~32 KB input without an @ forces re-scanning from...

CVE-2026-82617

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULTREGEXNAMEFINDER.EMAIL and DEFAULTREGEXNAMEFINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders...

PT-2026-90004

Name of the Vulnerable Software and Affected Versions Apache OpenNLP versions 2.0.0 through 2.5.11 Apache OpenNLP versions 3.0.0-M1 through 3.0.0-M5 Description Two built-in name-finder patterns in opennlp.tools.namefind.RegexNameFinderFactory specifically DEFAULT REGEX NAME FINDER.EMAIL and...

CVE-2026-82617: Inefficient Regular Expression Complexity

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULTREGEXNAMEFINDER.EMAIL and DEFAULTREGEXNAMEFINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders...

PT-2026-85252

Name of the Vulnerable Software and Affected Versions Colord versions prior to 2.9.4 Description Synchronous CSS color string matchers use an ambiguous numeric regular expression that allows digits to be divided between overlapping quantifiers in quadratically many ways when malformed input is...

EUVD-2026-43098

Phalcon: Catastrophic backtracking ReDoS in the default Phalcon Router route lead to remote unauthenticated DoS...

SUSE CVE-2026-57584

Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default router registers a built-in route whose compiled PCRE pattern contains the nested quantifier /., and the same construct is produced by the /:params placeholder and the CLI...

CVE-2026-45305

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser::cleanup used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup,...

CVE-2026-55574

A flaw was found in vLLM, a high-throughput and memory-efficient inference and serving engine for large language models LLMs. A remote attacker could exploit this vulnerability by providing a specially crafted regular expression to the structuredoutputs.regex API parameter. This adversarial regex...

GHSA-X4HG-HFWF-P9MW @asymmetric-effort/nogginlessdom vulnerable to ReDoS via user-controlled regex in HTMLInputElement pattern validation

Summary The HTMLInputElement.checkValidity method constructed a RegExp directly from the user-controlled pattern property without any sanitization or timeout protection. This allowed an attacker to inject a regex with catastrophic backtracking, freezing the event loop. Fix Fixed in commit...

minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions

A flaw was found in minimatch. A remote attacker could exploit this vulnerability by providing a specially crafted glob expression with nested unbounded quantifiers. This could lead to catastrophic backtracking in the V8 JavaScript engine, causing the application to become unresponsive and...

GHSA-9FRC-8383-795M Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex

Description Symfony\Component\Yaml\Parser::cleanup strips the optional %YAML directive header, leading comments, and document start/end markers before parsing. The original regexes contained overlapping quantifiers, most notably '^%YAML: \d.+.\nu', whose \d.+ and . overlap on the dot, that exhibi...

Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex

Description Symfony\Component\Yaml\Parser::cleanup strips the optional %YAML directive header, leading comments, and document start/end markers before parsing. The original regexes contained overlapping quantifiers, most notably '^%YAML: \d.+.\nu', whose \d.+ and . overlap on the dot, that exhibi...