vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m

SummaryThe fix for GHSA-rwxx-mrjm-wc2m "ReDoS via structuredoutputs.regex compiled without timeout" wrapped the regex compile in the xgrammar and outlines backends with compileregexwithtimeout and, for outlines, validateregexisbuildable. The lm-format-enforcer backend was left unguarded: it...

CVE-2026-8376 Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perlstudychunk in regcompstudy.c checked the size of the joined substring buffer in characters...

njs:njs_process_script_fuzzer: Stack-use-after-return in njs_regexp_compile_trace_handler

Project: http://hg.nginx.org/njs Detailed Report: https://oss-fuzz.com/testcase?key=4909814505406464 Project: njs Fuzzing Engine: libFuzzer Fuzz Target: njsprocessscriptfuzzer Job Type: libfuzzerasannjs Platform Id: linux Crash Type: Stack-use-after-return READ 4 Crash Address: 0x7ff81c360b24 Cra...