4945 matches found
CVE-2024-22640
CVE-2024-22640 Vulnerability Type Regular expression Denial of Service ReDoS Affected Product and Version TCPDF convertHTMLColorToDec'"t"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000!',$ref; ? Note: Checking with...
git-vuln-finder
git-vuln-finder Finding potential software vulnerabilities from git commit messages. The output format is a JSON with the associated commit which could contain a fix regarding a software vulnerability. The search is based on a set of regular expressions against the commit messages only. If CVE ID...
exploit-workshop
exploit-workshop In this step by step workshop you'll learn how to exploit various real world vulnerabilities existing in vulnerable versions of packages in a Node.js and Java application. Required software you need to install for this workshop You can do this workshop in 2 different flavours Usi...
regexploit
Regexploit Find regexes which are vulnerable to Regular Expression Denial of Service ReDoS. More info onthe Doyensec blog Many default regular expression parsers have unbounded worst-case complexity. Regex matching may be quick when presented with a matching input string. However, certain...
CVE-2024-27088
CVE-2024-27088 취약점 개요 CVE-2024-27088 Feb 26, 2024 ReDoS in node.js package rebob 프로젝트의 일환 취약점 설명 github advisories /^\sfunction\s\0-'-\uffff+\s\0--\uffff\s/ This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently...
CVE-2023-43646
CVE-2023-43646 Vulnerability Overview CVE-2023-43646 CVSS : 8.6 Sep 26, 2023 ReDoS in node.js package Part of the rebob project Vulnerability Description github advisories /\sfunction?:\s|\s/^?:/+/\s^\/+/ This vulnerability can be exploited when there is an imbalance in parentheses, which results...
axios-redos
Axios Regular Expression Denial Of Service Attack This repo hold a POC of CVE-2021-3749. Overview A ReDoS regular expression denial of service flaw was found in the axios package. An attacker that is able to provide crafted input to the trim function may cause an application to consume an excessi...
CVE-2026-112901
The Pillow Python imaging library is vulnerable to a regular-expression denial of service (ReDoS) in its XBM header parser prior to version 13.0.0 . Specifically, in the XbmImageFile._open function, the XbmImagePlugin applies a backtracking expression to an attacker-controlled header when an appl...
CVE-2026-112901 Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile.open, when an application calls Image.open on a small crafted XBM file, XbmImagePlugin applies a backtracking expression to the attacker-controlle...
CVE-2026-112300 DiffSK configobj __init__.py _sectionmarker redos
A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function sectionmarker of the file configobj/init.py. The manipulation leads to inefficient regular expression complexity. Remote exploitation of the attack is possible. The project was informed ...
CVE-2026-112300
A Regular Expression Denial of Service (ReDoS ) vulnerability exists in DiffSK configobj up to version 5.0.9 . The flaw is located within the _sectionmarker function of the configobj/init .py file. This issue arises from inefficient regular expression complexity, which could allow for remote expl...
CVE-2022-45729
This repository does not have a README...
CVE-2023-32309
CVE-2023-32309...
CVE-2026-112366 Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like + or +a, which analyzeRepeatedExtglob in lib/parse.js skips, causing exponenti...
CVE-2026-112366 Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns
Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like + or +a, which analyzeRepeatedExtglob in lib/parse.js skips, causing exponenti...
CVE-2026-112366
The Picomatch library, through version 4.0.7 , is vulnerable to a Regular Expression Denial of Service (ReDoS) . The root cause lies in lib/parse.js, where the analyzeRepeatedExtglob function fails to properly handle single-branch repeated extglob patterns such as +(*) or +(*a). These patterns ca...
CVE-2020-5236
Waitress 1.4.2 ReDoS - CVE-2020-5236 Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the...
CVE-2023-4220
CVE-2023-4220...
CVE-2023-31606
CVE-2023-31606 Vulnerability A Regular Expression Denial of Service ReDoS issue was discovered in the sanitizehtml function of redcloth gem = v4.0.0. This vulnerability allows attackers to cause a Denial of Service DoS via supplying a crafted payload. What is ReDoS? As per OWASP - The Regular...