CVE-2026-100267

JetBrains YouTrack versions prior to 2026.2.19197 are vulnerable to a Regular Expression Denial of Service (reDoS) attack. The vulnerability exists in the mailbox regex mail-rule filters , where a specially crafted regex can cause significant resource exhaustion. The impact is a high availability...

CVE-2026-100267

In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters...

Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

Summary Axios for Node.js parses data: URLs in lib/helpers/fromDataURI.js. The current RFC-2397 parser uses a regular expression whose media type groups allow / inside both sides of the type/subtype match. A malformed data: URL containing many slashes and no comma forces the JavaScript regex engi...

NPM: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

NPM: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop DoS vulnerability discovered by ? in WordPress Npm axios versions = 1.16.1, 1.20.0...

GHSA-C29M-XWM3-CM6R Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

Summary Axios for Node.js parses data: URLs in lib/helpers/fromDataURI.js. The current RFC-2397 parser uses a regular expression whose media type groups allow / inside both sides of the type/subtype match. A malformed data: URL containing many slashes and no comma forces the JavaScript regex engi...

Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

Summary Axios shouldBypassProxy normalizes hostnames with hostname.replace/.+$/, ''. For a hostname shaped as many dots followed by a non-dot, the anchored regex can perform quadratic backtracking. Because axios re-evaluates proxy bypass rules for redirected requests, a malicious server can...

GHSA-MGHH-PGCX-3JJJ Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

Summary Axios shouldBypassProxy normalizes hostnames with hostname.replace/.+$/, ''. For a hostname shaped as many dots followed by a non-dot, the anchored regex can perform quadratic backtracking. Because axios re-evaluates proxy bypass rules for redirected requests, a malicious server can...

NPM: Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

NPM: Axios: ReDoS ON² in shouldBypassProxy host normalization, reachable via untrusted redirect Location vulnerability discovered by ? in WordPress Npm axios versions = 1.15.0, 1.20.0...

PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

Summary There is a Re-DoS vulnerability in the ispemformat function which results in a intesive CPU usage if an attacker is been able to provide a custom certificate. Details The problem is that the lazy quantifier .+? will always first try to match as little as possible until it finds a ---- END...

GHSA-JWRC-G2Q2-PQ5P PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

Summary There is a Re-DoS vulnerability in the ispemformat function which results in a intesive CPU usage if an attacker is been able to provide a custom certificate. Details The problem is that the lazy quantifier .+? will always first try to match as little as possible until it finds a ---- END...

AlmaLinux 9.2 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc (ALMALINUX9.2:CLSA-2025:1755617966)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1755617966 advisory. - A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific...

AlmaLinux 9.2 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc (ALMALINUX9.2:CLSA-2026:1779099998)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779099998 advisory. - A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have...

AlmaLinux 9.2 [TuxCare] Security Update: nodejs / nodejs-devel / nodejs-docs / nodejs-full-i18n / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1777394614)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1777394614 advisory. - Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service ReDoS via the function new Rang...

CVE-2026-89407

A flaw was found in jackson-core. An attacker can supply specially crafted JSON that, when deserialized into a numeric target type, triggers a Regular expression Denial of Service ReDoS vulnerability. This occurs due to quadratic backtracking in the NumberInput.looksLikeValidNumber method's...

EUVD-2026-89427

crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions in think-tag response parsing on Ruby 3.1.x. A malicious or anomalous model response containing many unterminated tags can cause excessive CPU consumption in t...

CVE-2026-67987

crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time regular expression denial-of-service conditions in think-tag response parsing on Ruby 3.1.x. A malicious or anomalous model response containing many unterminated tags can cause excessive CPU consumption in t...

Regular Expression Denial of Service (ReDoS)

Overview org.webjars.npm:brace-expansion is a WebJar for brace-expansion. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the expand function, which implements a Bash quirk where a brace group followed by a comma set e.g. a,b causes the parser to...

Regular Expression Denial of Service (ReDoS)

Overview brace-expansion is a Brace expansion as known from sh/bash Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the expand function, which implements a Bash quirk where a brace group followed by a comma set e.g. a,b causes the parser to rewri...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via ispemformat in jwt/utils.py, which previously used a regex PEMRE that accepted PEM formatting variants recognised by the underlying cryptography loader but not explicitly validated by pyjwt...

CVE-2026-102270 PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT ispemformat is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, ispemforma...