regexploit

Regexploit Find regexes which are vulnerable to Regular Expression Denial of Service ReDoS. More info onthe Doyensec blog Many default regular expression parsers have unbounded worst-case complexity. Regex matching may be quick when presented with a matching input string. However, certain...

recheck

recheck The trustworthy ReDoS checker License MIT License. 2020-2026 C TSUYUSATO "MakeNowJust" Kitsune...

exploit-workshop

exploit-workshop In this step by step workshop you'll learn how to exploit various real world vulnerabilities existing in vulnerable versions of packages in a Node.js and Java application. Required software you need to install for this workshop You can do this workshop in 2 different flavours Usi...

CVE-2023-32309

CVE-2023-32309...

CVE-2024-22640

CVE-2024-22640 Vulnerability Type Regular expression Denial of Service ReDoS Affected Product and Version TCPDF convertHTMLColorToDec'"t"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000!',$ref; ? Note: Checking with...

git-vuln-finder

git-vuln-finder Finding potential software vulnerabilities from git commit messages. The output format is a JSON with the associated commit which could contain a fix regarding a software vulnerability. The search is based on a set of regular expressions against the commit messages only. If CVE ID...

CVE-2026-128345

ExcelJS versions through 4.4.0 are vulnerable to a Regular Expression Denial of Service (ReDoS) in the slideFormula function located in lib/utils/shared-formula.js. The root cause is triggered during the translation of shared formulas to child cells, where a crafted spreadsheet containing very lo...

PoC-CVE-2025-25200

CVE-2025-25200 Context Vulnerability: CVE-2025-25200 Type: Regular Expression Denial of Service ReDoS Component: Kao = 2.0.0, = 3.0.0-alpha.0, = 1.0.0, 1.7.1, 0.21.2 Description: This vulnerability presents quadratic time complexity On² or, in more critical scenarios, exponential O2ⁿ, meaning the...

axios-redos

Axios Regular Expression Denial Of Service Attack This repo hold a POC of CVE-2021-3749. Overview A ReDoS regular expression denial of service flaw was found in the axios package. An attacker that is able to provide crafted input to the trim function may cause an application to consume an excessi...

CVE-2020-5236

Waitress 1.4.2 ReDoS - CVE-2020-5236 Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the...

CVE-2026-126191 Soup Sieve: Exponential ReDoS in selector compilation via \9-run in CSS_ESCAPES/IDENTIFIER

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 3.0, the CSSESCAPES and IDENTIFIER regular-expression subpatterns can backtrack exponentially on runs of ambiguous digit escapes in an attribute-name or tag position of an otherwise valid selector. The failur...

CVE-2026-126191

The Soup Sieve CSS selector library, used with Beautiful Soup 4 , is vulnerable to exponential regular-expression backtracking in versions prior to 3.0 . The vulnerability exists because the CSS_ESCAPES and IDENTIFIER subpatterns can backtrack exponentially when processing ambiguous digit escapes...

CVE-2026-126191 Soup Sieve: Exponential ReDoS in selector compilation via \9-run in CSS_ESCAPES/IDENTIFIER

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 3.0, the CSSESCAPES and IDENTIFIER regular-expression subpatterns can backtrack exponentially on runs of ambiguous digit escapes in an attribute-name or tag position of an otherwise valid selector. The failur...

CVE-2023-43646

CVE-2023-43646 Vulnerability Overview CVE-2023-43646 CVSS : 8.6 Sep 26, 2023 ReDoS in node.js package Part of the rebob project Vulnerability Description github advisories /\sfunction?:\s|\s/^?:/+/\s^\/+/ This vulnerability can be exploited when there is an imbalance in parentheses, which results...

RHLW-2026-7DCB1A44E2EDEB0E Lightwell Security Advisory: jackson-core 2.17.3.rhlw-00005

Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-core 2.17.3.rhlw-00005 with backported fixes for CVE-2026-18401, CVE-2026-68494, CVE-2026-89407, and CVE-2026-89425. CVE-2026-18401: jackson-core: Number length constraint bypass in non-blocking async JSON parser leads to potential...

CVE-2022-45729

This repository does not have a README...

CVE-2023-31606

CVE-2023-31606 Vulnerability A Regular Expression Denial of Service ReDoS issue was discovered in the sanitizehtml function of redcloth gem = v4.0.0. This vulnerability allows attackers to cause a Denial of Service DoS via supplying a crafted payload. What is ReDoS? As per OWASP - The Regular...

Security update for python-Twisted

This update for python-Twisted fixes the following issues: CVE-2026-83813: DNS spoofing in twisted.names due to missing source address validation bsc1287833. CVE-2026-106454: ReDoS due to improper use of re.compile in wildcardToRegexp bsc1284420. CVE-2026-115774: denial of service via negative si...

CVE-2026-61619

The OWASP core rule set CRS is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, regular-expression denial of service ReDoS affects a shared regex-assembly include used to build 12 Unix RCE detection rules in C...

EUVD-2026-123632

The OWASP core rule set CRS is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, regular-expression denial of service ReDoS affects a shared regex-assembly include used to build 12 Unix RCE detection rules in C...