CVE-2024-27088

CVE-2024-27088 취약점 개요 CVE-2024-27088 Feb 26, 2024 ReDoS in node.js package rebob 프로젝트의 일환 취약점 설명 github advisories /^\sfunction\s\0-'-\uffff+\s\0--\uffff\s/ This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently...

CVE-2023-43646

CVE-2023-43646 Vulnerability Overview CVE-2023-43646 CVSS : 8.6 Sep 26, 2023 ReDoS in node.js package Part of the rebob project Vulnerability Description github advisories /\sfunction?:\s|\s/^?:/+/\s^\/+/ This vulnerability can be exploited when there is an imbalance in parentheses, which results...

CVE-2026-115887 graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service

GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits...

RLSA-2026:86706 Moderate: jackson-core security update

Core part of Jackson that defines Streaming API as well as basic shared abstractions. Security Fixes: com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking CVE-2026-89407 com.fasterxml.jackson.core/jackson-core:...

jackson-core security update

An update is available for jackson-core. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Core part of Jackson that defines Streaming API as well as basic shared...

Rocky Linux 9 [CIQ] Security Update: pki-jackson-core Multiple Vulnerabilities (crlsa-2026_86706)

The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202686706 advisory. com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking CVE-2026-89407...

RHEL 9 : jackson-core (RHSA-2026:86706)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:86706 advisory. Core part of Jackson that defines Streaming API as well as basic shared abstractions. Security Fixes: com.fasterxml.jackson/jackson-core:...

Moderate: jackson-core security update

Core part of Jackson that defines Streaming API as well as basic shared abstractions. Security Fixes: com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking CVE-2026-89407 com.fasterxml.jackson.core/jackson-core:...

Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs

Summary Vulnerability in jackson-core.jar in IBM Integration Designer: CVE-2026-89407 and CVE-2026-89425 Vulnerability Details CVEID:CVE-2026-89407 DESCRIPTION: NumberInput.looksLikeValidNumber in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERNFLOA...

Important: jackson-core

Issue Overview: NumberInput.looksLikeValidNumber in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERNFLOAT +-?0-9\.?0-9+eE+-?0-9+?, present since 2.17.0, and PATTERNFLOATTRAILINGDOT, added in 2.17.2. PATTERNFLOAT places adjacent quantifiers over the...

Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

Summary One unauthenticated request with a crafted User-Agent stalls a Quasar SSR server for seconds. Quasar auto-installs its Platform plugin on every server-side render, and Platform.parseSSR feeds the raw, unbounded User-Agent request header into a chain of backtracking regular expressions in...

GHSA-68JQ-FHCH-4XQ4 Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

Summary One unauthenticated request with a crafted User-Agent stalls a Quasar SSR server for seconds. Quasar auto-installs its Platform plugin on every server-side render, and Platform.parseSSR feeds the raw, unbounded User-Agent request header into a chain of backtracking regular expressions in...

NPM: Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

NPM: Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server vulnerability discovered by ? in WordPress Npm quasar versions = 2.23.2...

CVE-2026-106454

A flaw was found in Twisted. An authenticated remote attacker can cause a Denial of Service DoS by submitting specially crafted mailbox search queries using Internet Message Access Protocol IMAP commands such as LIST or LSUB. Because the server fails to properly sanitize these search patterns...

CVE-2026-106104 Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR passed an unbounded User-Agent request header to getMatch in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated...

CVE-2026-106104 Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR passed an unbounded User-Agent request header to getMatch in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated...

CVE-2026-106104

The Quasar Framework (prior to version 2.23.3 ) is vulnerable to a Regular Expression Denial of Service (ReDoS) . The Platform.parseSSR() function in ui/src/plugins/platform/Platform.js processes an unbounded User-Agent request header using browser-detection expressions that combine greedy captur...

CVE-2026-67240

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, patterntoregex maps % - .? and - ., then compiles ^...$ with only unicode; re:run is called with only capture, none - no explicit matchlimit. A pattern like %%...%X becomes ^.?..?.....?.X$ with overlapping lazy...

DEBIAN-CVE-2026-77420

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatternsString patterns, String line in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORYIGNORE configuration value into a Java regular expression...

UBUNTU-CVE-2026-77420

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatternsString patterns, String line in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORYIGNORE configuration value into a Java regular expression...