BIT-PYTHON-MIN-2026-18503 Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

BIT-LIBPYTHON-2026-18503 Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

PT-2026-73439

A Regular Expression Denial of Service ReDoS vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sql parse.py component, specifically within the SQL REGEX used for parsing SQL statements in the sqlparse library integration. The affected regula...

CVE-2026-73556

A flaw was found in vLLM, an inference and serving engine for large language models. An unauthenticated remote attacker can exploit a Regular Expression Denial of Service ReDoS vulnerability in the lm-format-enforcer backend. By submitting a specially crafted regular expression through the...

GO-2025-3764 vulnerabilities

Vulnerabilities for packages: nuclei...

Linux Distros Unpatched Vulnerability : CVE-2026-73643

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load o...

ca.uhn.hapi.fhir/org.hl7.fhir.dstu2: ca.uhn.hapi.fhir/org.hl7.fhir.convertors: ca.uhn.hapi.fhir/org.hl7.fhir.validation: ca.uhn.hapi.fhir/org.hl7.fhir.validation.cli: HAPI FHIR: Denial of Service via Regular Expression Backtracking in DSTU2 Module

A flaw was found in HAPI FHIR, a Java implementation of the HL7 FHIR standard. The fix for a previous vulnerability CVE-2026-45367 was incomplete in the DSTU2 module. Specifically, the FHIRPathEngine.matches function in org.hl7.fhir.dstu2 did not include protection against regular expression...

CVE-2026-73556

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structuredoutputs.regex parameter in vllm/v1/structuredoutput/backendlmformatenforcer.py is passed to lmformatenforcer.RegexParser without compileregexwithtimeout or validation in...

CVE-2026-73556

vLLM before 0.26.0 is affected by a DoS-like issue in the lm-format-enforcer backend: structured_outputs.regex is passed to RegexParser without compile_timeout or validation in validate_structured_output_request_lm_format_enforcer, allowing unauthenticated /v1/completions requests to consume CPU ...

CVE-2026-73556 vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structuredoutputs.regex parameter in vllm/v1/structuredoutput/backendlmformatenforcer.py is passed to lmformatenforcer.RegexParser without compileregexwithtimeout or validation in...

CVE-2026-73556 vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of CVE-2026-55574

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structuredoutputs.regex parameter in vllm/v1/structuredoutput/backendlmformatenforcer.py is passed to lmformatenforcer.RegexParser without compileregexwithtimeout or validation in...

python: Python: Denial of Service via super-linear regular expression work in csv.Sniffer.sniff()

A flaw was found in the csv.Sniffer.sniff function within Python. An attacker can exploit this by providing specially crafted CSV samples, which can trigger super-linear regular-expression processing during dialect sniffing. This excessive processing consumes significant CPU resources, potentiall...

EUVD-2026-58032

crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in RubyLLM::Utils.underscore on Ruby 3.1.x. A very long crafted class, agent, or tool name can cause excessive CPU consumption and a denial of service...

CVE-2026-67991

crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in RubyLLM::Utils.underscore on Ruby 3.1.x. A very long crafted class, agent, or tool name can cause excessive CPU consumption and a denial of service...

PT-2026-71671

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured outputs.regex parameter in vllm/v1/structured output/backend lm format enforcer.py is passed to lmformatenforcer.RegexParser without compile regex with timeout or validation in validate structured...

openSUSE 16 Security Update : perl-Date-Manip (openSUSE-SU-2026:21552-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21552-1 advisory. This update for perl-Date-Manip fixes the following issues - CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits...

CVE-2026-73088

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats in node.js, reached unconditionally through getStat and loadStat on every browserslist call, processes untrusted browserslist-stats.json, opts.stats, and...

DoS (Denial of Service) minimatch Dependency in Bitbucket Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 9.4.22, 10.2.5, 10.3.0, and 10.4.1 of Bitbucket Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an...

CVE-2026-72912

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed recipe= URL fragment containing a large number of unmatched quote characters reaches...

CVE-2026-72912 CyberChef’s pretty-recipe parser vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URL

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed recipe= URL fragment containing a large number of unmatched quote characters reaches...