EEF-CVE-2026-68749 Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service

Summary Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the...

CVE-2026-71190

In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking ReDoS. The "qdtext" pattern ?:^"|\. allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in...

SUSE SLED15 / SLES15 Security Update : perl-HTTP-Date (SUSE-SU-2026:3454-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3454-1 advisory. This update for perl-HTTP-Date fixes the following issue - CVE-2026-14741: CPU exhaustion due to polynomial regex...

SUSE-SU-2026:3454-1 Security update for perl-HTTP-Date

This update for perl-HTTP-Date fixes the following issue - CVE-2026-14741: CPU exhaustion due to polynomial regex backtracking in parsedate when processing specially crafted date strings bsc1271705...

CVE-2026-53504

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated numeric input, allowing a URL request to exhaust processing time. This issue is fixed in 7.8.0...

SUSE SLES12 Security Update : perl-HTTP-Date (SUSE-SU-2026:3334-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3334-1 advisory. This update for perl-HTTP-Date fixes the following issue: - CVE-2026-14741: CPU exhaustion due to polynomial regex backtracking in parsedate when...

SUSE-SU-2026:3334-1 Security update for perl-HTTP-Date

This update for perl-HTTP-Date fixes the following issue: - CVE-2026-14741: CPU exhaustion due to polynomial regex backtracking in parsedate when processing specially crafted date strings bsc1271705...

Security update for perl-HTTP-Date

This update for perl-HTTP-Date fixes the following issue: CVE-2026-14741: CPU exhaustion due to polynomial regex backtracking in parsedate when processing specially crafted date strings bsc1271705. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like...

SUSE SLES16: jline3 / jline3-builtins / jline3-console / jline3-console-ui / etc (SUSE-SU-2026:22856-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22856-1 advisory. - CVE-2026-56740: unauthenticated remote memory exhaustion via unbounded Telnet NEW-ENVIRON variables bsc1269021. - CVE-2026-56741...

SUSE SLES16 Security Update : perl-HTTP-Date (SUSE-SU-2026:22859-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:22859-1 advisory. This update for perl-HTTP-Date fixes the following issue - CVE-2026-14741: CPU exhaustion via polynomial regex backtracking in parsedate...

openSUSE 16 Security Update : perl-HTTP-Date (openSUSE-SU-2026:21427-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21427-1 advisory. This update for perl-HTTP-Date fixes the following issue - CVE-2026-14741: CPU exhaustion via polynomial regex backtracking in parsedate bsc1271705...

Security update for perl-HTTP-Date (moderate)

openSUSE security update: security update for perl-http-date ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21427-1 Rating: moderate References: bsc1271705 Cross-References: CVE-2026-14741 CVSS scores: CVE-2026-14741 SUSE : 5.3...

SUSE-SU-2026:22859-1 Security update for perl-HTTP-Date

This update for perl-HTTP-Date fixes the following issue - CVE-2026-14741: CPU exhaustion via polynomial regex backtracking in parsedate bsc1271705...

GHSA-V96J-25GV-G2W9 Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

This issue has been found by a security agent and review by myself. Gitea's CODEOWNERS feature uses the regexp2 library to match file paths against ownership rules. User-supplied patterns are passed directly to regexp2.Compile with no sanitisation and no match timeout. This allows an attacker to...

SUSE CVE-2026-14741

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parsedate. parsedate matches the date string against a chain of alternative regexes, and str2time delegates to it. Several of these patterns place unbounded quantifiers next to each other before a...

CVE-2026-52746

JSONata is a JSON query and transformation language. Prior to 2.2.0 and 1.8.9, malicious non-matching inputs to the $toMillis function can cause superlinear backtracking in the ISO-8601 validation regex, leading to denial of service in applications that evaluate user-provided JSONata expressions...

CVE-2026-14741

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parsedate. parsedate matches the date string against a chain of alternative regexes, and str2time delegates to it. Several of these patterns place unbounded quantifiers next to each other before a...

CVE-2026-14741

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parsedate. parsedate matches the date string against a chain of alternative regexes, and str2time delegates to it. Several of these patterns place unbounded quantifiers next to each other before a...

CVE-2026-14741

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parsedate. parsedate matches the date string against a chain of alternative regexes, and str2time delegates to it. Several of these patterns place unbounded quantifiers next to each other before a...

CVE-2026-14741 HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parsedate. parsedate matches the date string against a chain of alternative regexes, and str2time delegates to it. Several of these patterns place unbounded quantifiers next to each other before a...