CVE-2026-76821 OpenCTI: User-Controlled ReDoS in JSON Ingestion Mapper

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260706.0, the JSON ingestion mapper's extractWithRegexp formula function compiled a user-supplied regular expression with the JavaScript RegExp engine in...

EUVD-2026-77699

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a...

CVE-2026-57577 DotVVM: ReDOS in routing

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a...

CVE-2026-57577 DotVVM: ReDOS in routing

DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a...

CVE-2020-5236

Waitress 1.4.2 ReDoS - CVE-2020-5236 Waitress バージョン 1.4.2 は、Waitress が不正な文字を含むヘッダーを受信したとき、DOS 攻撃を許容します。"Bad-header: xxxxxxxxxxxxxxx\x10" のようなヘッダーを受信すると、正規表現エンジンが破滅的なバックトラッキングを引き起こし、プロセスが CPU 時間を 100% 使用して他の操作をすべてブロックします。これにより、攻撃者は不正なヘッダーを含む単一のリクエストを送信し、サービスをオフラインにすることができます。 NVD による 使用方法...

Astra Linux – Vulnerability in node-minimatch

Minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, matchOne performed unbounded recursive backtracking when a glob pattern contained multiple non-adjacent GLOBSTAR...

CVE-2023-4220

CVE-2023-4220...

CVE-2023-31606

CVE-2023-31606 脆弱性 redcloth gem バージョン 4.0.0 以上の sanitizehtml 関数において、正規表現サービス拒否（ReDoS）の問題が発見されました。この脆弱性により、攻撃者は細工されたペイロードを提供することでサービス拒否（DoS）を引き起こすことができます。 ReDoSとは？ OWASP...

CVE-2024-27088

CVE-2024-27088 脆弱性の概要 CVE-2024-27088 Feb 26, 2024 ReDoS in node.js package rebobプロジェクトの一環 脆弱性の説明 github advisories root@kitploit: /^\sfunction\s\0-'-\uffff+\s\0--\uffff\s/ この脆弱性は、括弧のバランスが崩れている場合に悪用される可能性があり、過剰なバックトラッキングが発生し、CPU負荷と処理時間が大幅に増加します。この脆弱性は以下の入力を使用してトリガーできます: 'function' + 'n'.repeat31 +...

CVE-2023-43646

CVE-2023-43646 脆弱性概要 CVE-2023-43646 CVSS : 8.6 Sep 26, 2023 node.jsパッケージにおけるReDoS rebobプロジェクトの一環 脆弱性説明 github advisories root@kitploit: /\sfunction?:\s|\s/^?:/+/\s^\/+/ この脆弱性は、括弧に不均衡がある場合に悪用される可能性があり、過度のバックトラッキングを引き起こし、その結果CPU負荷と処理時間が大幅に増加します。この脆弱性は、以下の入力を使用してトリガーできます: root@kitploit:...

Linux Distros Unpatched Vulnerability : CVE-2026-82617

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULTREGEXNAMEFINDER.EMAIL and DEFAULTREGEXNAMEFINDER.URL -...

DEBIAN-CVE-2026-82617

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULTREGEXNAMEFINDER.EMAIL and DEFAULTREGEXNAMEFINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders...

CVE-2026-82617

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULTREGEXNAMEFINDER.EMAIL and DEFAULTREGEXNAMEFINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders...

CVE-2026-82617

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULTREGEXNAMEFINDER.EMAIL and DEFAULTREGEXNAMEFINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders...

CVE-2026-82617 Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULTREGEXNAMEFINDER.EMAIL and DEFAULTREGEXNAMEFINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders...

EUVD-2026-76169

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULTREGEXNAMEFINDER.EMAIL and DEFAULTREGEXNAMEFINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders...

CVE-2026-82617

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULTREGEXNAMEFINDER.EMAIL and DEFAULTREGEXNAMEFINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders...

CVE-2026-82617

Apache OpenNLP versions 2.0.0 through 2.5.11 and 3.0.0-M1 through 3.0.0-M5 are affected by ambiguous nested quantifiers in the built-in EMAIL and URL name-finder patterns of RegexNameFinderFactory. The EMAIL pattern suffers quadratic-time ReDoS: a ~32 KB input without an @ forces re-scanning from...

GHSA-JP53-MHQP-8XCG vulnerabilities

Vulnerabilities for packages: open-webui...

PT-2026-90004

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT REGEX NAME FINDER.EMAIL and DEFAULT REGEX NAME FINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through...