recheck

recheck The trustworthy ReDoS checker License MIT License. 2020-2025 C TSUYUSATO "MakeNowJust" Kitsune...

Astra Linux – Vulnerability in Mako

Sqlalchemy mako before version 1.2.2 is vulnerable to Regular Expression Denial of Service when using the Lexer class for parsing. This vulnerability also affects babelplugin and linguaplugin...

Astra Linux – Vulnerability in libonig

A use-after-free in the onignewdeluxe function in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regular expression pattern and a...

Astra Linux – Vulnerability in python-py

A denial of service attack via regular expressions in the py.path.svnwc component of py also known as python-py in versions up to 1.9.0 could be exploited by attackers to trigger a compute-time denial of service attack by providing malicious input to the blame functionality...

Astra Linux – Vulnerability in sqlparse

sqlparse is a non-validation SQL parser module for Python. In affected versions, the SQL parser contains a regular expression that is vulnerable to ReDoS Regular Expression Denial of Service. This issue was introduced by the commit e75e358. The vulnerability may lead to Denial of Service DoS. Thi...

Astra Linux – Vulnerability in Thunderbird, Firefox

Regular expressions used to filter out forbidden properties and values from style directives in calls to console.log did not account for external URLs. As a result, data could potentially be exfiltrated from the browser. This vulnerability affects Firefox 109, Firefox ESR 102.7, and Thunderbird...

Astra Linux – Vulnerability in libonig

A NULL pointer dereference in the matchat function in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause a denial of service by providing a crafted regular expression. Oniguruma vulnerabilities often affect Ruby, as well as common optional libraries used in PHP and Rust...

Astra Linux – Vulnerability in node-ssri

ssri 5.2.2-8.0.0; fixed in 8.0.1. This version processes SRIs using a regular expression, which is vulnerable to a denial-of-service attack. Malicious SRIs could take an extremely long time to process, resulting in a denial of service. This issue only affects consumers who use the “strict” option...

EUVD-2026-54084

Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to exhaust server CPU via a long CSS declaration in sanitized HTML. The declaration regex in HtmlSanitizeEx.Scrubber.CSS.scrub/1 matches the property name...

CVE-2026-71190

A flaw was found in OpenStack Swift's proxy server. The Accept header parser uses a regular expression that is vulnerable to catastrophic backtracking. An unauthenticated attacker can send a crafted Accept header with a small number of backslash characters in an unterminated quoted string, causin...

OPENSUSE-SU-2026:21524-1 Security update for nginx

This update for nginx fixes the following issue - CVE-2026-42533: map directive and regex matching vulnerability bsc1271514...

re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)

Summary re2 validates the user-settable lastIndex against the subject's UTF-8 byte length but then uses it as a UTF-16 code-unit count to walk the subject buffer, with no bounds check. For any non-ASCII subject, the byte length is larger than the true character count, so a lastIndex between those...

@ahmedwalid05/instagram-private-api (>=1.43.6-0, <=1.43.9), @alwaysmeticulous/cli (>=2.306.0, <=2.308.0) +161 more potentially affected by CVE-2026-68499 via re2 (>=1.8.4, <=1.25.1)

re2 NPM version =1.8.4, =1.43.6-0, =2.306.0, =2.306.0, =1.43.3, =0.1.0, =8.0.0, =8.1.31, =8.0.0, =8.0.0, =1.0.9, =0.0.0-semantic-release, =0.1.1, =1.1.0, =1.2.4 and more Source cves: CVE-2026-68499 Source advisory: OSV:GHSA-6HXR-MR5R-9836...

CVE-2026-23985

A Regular Expression Denial of Service ReDoS vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sqlparse.py component, specifically within the SQLREGEX used for parsing SQL statements in the sqlparse library integration. The affected regular...

CVE-2026-22068

Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue...

CVE-2026-22068 Apache Traffic Server: Regex mappings match with malicious domain names

Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue...

CVE-2026-22068

Apache Traffic Server is affected by a Regular Expression without Anchors vulnerability (CVE-2026-22068). Affected versions are 10.0.x through 10.1.3 and 9.0.x through 9.2.14. The issue is addressed in versions 9.2.15 and 10.1.4. Exploitation status is not provided in the documents. CVSS data is ...

SUSE-SU-2026:22917-1 Security update for afterburn

This update for afterburn fixes the following issues Update to version 5.10.0.git73.b97f772. Security issues fixed: - CVE-2022-24713: regex: high complexity when parsing regexes with large repetitions on empty sub-expressions can lead to DoS bsc1196972. - CVE-2024-12224: idna: privilege escalatio...

CVE-2026-49485

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation, and the FHIRPath functions matches,...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the matches, matchesFull, and replaceMatches functions in FHIRPath expression evaluation. An attacker can exhaust system CPU resources by submitting specially crafted regular expressions th...