PYSEC-2026-4218 geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point

Impact geopy.Point and Point.fromstring may take excessive CPU time when parsing long, malformed coordinate strings due to inefficient regular-expression behavior. The numeric Point constructor is not affected. Geocoders' reverse methods called with string inputs exercise the vulnerable path...

Security Bulletin: Multiple vulnerabilties in IBM Rational Functional Tester / DevOps Test UI

Summary Multiple vulnerabilities addressed in DevOps Test UI in version 11.0.9 Vulnerability Details CVEID:CVE-2026-33671 DESCRIPTION: Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service ReDoS when...

CVE-2026-88753

The trentm markdown2 library versions through v2.5.5 is vulnerable to a Regular-Expression Denial of Service (ReDoS) in the extract_metadata() function located in lib/markdown2.py. An attacker can exploit this by providing a crafted Markdown document, which triggers an inefficient regular express...

PT-2026-115002

Name of the Vulnerable Software and Affected Versions markdown2 versions prior to 2.5.5 Description A Regular-Expression Denial of Service ReDoS exists in the extract metadata function within the lib/markdown2.py file. An attacker can trigger this issue by providing a specially crafted Markdown...

CVE-2026-88753: Undefined Security Weakness

A Regular-Expression Denial of Service ReDoS in the Markdown2. extractmetadata function lib/markdown2.py of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service DoS via a crafted Markdown document...

EUVD-2026-102186

A Regular-Expression Denial of Service ReDoS in the Markdown2. extractmetadata function lib/markdown2.py of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service DoS via a crafted Markdown document...

CVE-2026-88753

A Regular-Expression Denial of Service ReDoS in the Markdown2. extractmetadata function lib/markdown2.py of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service DoS via a crafted Markdown document...

python36:3.6 security update

python36 3.6.8-39 - Provide /usr/bin/python3 explicitly - Resolves: RHEL-2113 python-distro 1.4.0-2 - Port from Fedora to RHEL8, part of the python36 module - Resolves: rhbz1678920 python-docs 3.6.7-2 - Bumping due to problems with modular RPM upgrade path - Resolves: rhbz1695587 python-docutils...

CVE-2026-88753

A Regular-Expression Denial of Service ReDoS in the Markdown2. extractmetadata function lib/markdown2.py of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service DoS via a crafted Markdown document...

CVE-2026-110869

The Nodemailer library (versions 3.0.0 before 10.0.13 ) is vulnerable to a Regular Expression Denial of Service (ReDoS) in the SMTPConnection._actionEHLO function. The issue stems from four AUTH mechanism detection regexes containing overlapping whitespace sub-patterns that lead to quadratic back...

CVE-2026-110869 Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes

Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection.actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with...

CVE-2026-110869 Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes

Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection.actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with...

CVE-2026-110856 GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date

GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the reactorepoch pattern used by parseactoranddate on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch o...

CVE-2026-110856 GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date

GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the reactorepoch pattern used by parseactoranddate on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch o...

CVE-2026-110856

The GitPython library (versions prior to 3.2.0 ) is vulnerable to a Regular Expression Denial of Service (ReDoS) via the _re_actor_epoch pattern. This vulnerability exists within the parse_actor_and_date function, which processes author, committer, and tagger lines. An attacker can trigger quadra...

CVE-2026-110594 BottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex

BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern...

CVE-2026-110594

BottleCRM versions 0.43 through 1.14.5 are vulnerable to a Regular Expression Denial of Service (ReDoS) . The flaw exists because the application evaluates unbounded routing rule regex patterns within the _match_condition() function during case saves. An authenticated organization administrator c...

CVE-2026-110594 BottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex

BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern...

CVE-2026-110594 BottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex

BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern...

CVE-2026-109563 N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex

N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event...