5018 matches found
axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name
A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service DoS, where the affected browser tab may...
PT-2026-81347
Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58 Description The Browser Server contains an authentication bypass in the handle connection function. The server validates incoming WebSocket connections by checking the Chrome extension origin using re.match...
EulerOS Virtualization 2.13.0 : perl (EulerOS-SA-2026-3227)
According to the versions of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit...
EulerOS Virtualization 2.13.1 : perl (EulerOS-SA-2026-3187)
According to the versions of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit...
PT-2026-81476
Name of the Vulnerable Software and Affected Versions eml parser versions prior to 3.0.2 Description The noparenthesis function in eml parser/routing.py uses a regex-based fix-point loop to remove parenthesized CFWS Comments and Folding White Space from Received: headers. The processing time for...
Astra Linux – Vulnerability in node-cookiejar
Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service ReDoS attacks through the Cookie.parse function, which uses an insecure regular expression...
Astra Linux – Vulnerability in JRuby
In Ruby, WEBrick::HTTPAuth::DigestAuth from versions 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 causes a denial-of-service attack due to a regular expression issue related to looping/backtracking. A victim must expose a WEBrick server that uses DigestAuth to the internet or a trusted...
Astra Linux – Vulnerability in node-glob-parent
This affects the glob-parent package before version 5.1.2. The enclosure regex used to check for strings ending with an enclosure containing a path separator is affected...
Astra Linux – Vulnerability in pcre2
A out-of-bounds read vulnerability was discovered in the PCRE2 library, specifically in the pcre2jitcompile.c file’s compilexclassmatchingpath function. This issue relates to a Unicode property matching problem in JIT-compiled regular expressions. The vulnerability arises because the character is...
Astra Linux – Vulnerability in python-py
A denial of service attack via regular expressions in the py.path.svnwc component of py also known as python-py in versions up to 1.9.0 could be exploited by attackers to trigger a compute-time denial of service attack by providing malicious input to the blame functionality...
Astra Linux – Vulnerability in Firefox and Thunderbird
When UpdateRegExpStatics attempted to access initialStringHeap, it might have already been garbage collected before entering the function. This could potentially lead to a exploitable crash. This vulnerability affects Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2...
Astra Linux – Vulnerability in ruby-websocket-extensions
The websocket-extensions Ruby module before version 0.1.5 allowed Denial of Service DoS attacks through Regex backtracking. The extension parser could take quadratic time when parsing a header containing an unclosed string parameter value whose content was a repeated two-byte sequence of a...
Astra Linux – Vulnerability found in Python 3.11, Python 2.7, Python 3.7, and Pypy
There is a medium-severity vulnerability affecting CPython. Regular expressions that allow excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS through specifically crafted tar archives...
Astra Linux – Vulnerability in dovecot
The Sieve engine in Dovecot before 2.3.15 allowed uncontrolled resource consumption, as demonstrated by a situation involving a complex regular expression for the regex extension...
Astra Linux – Vulnerability in libonig
A NULL pointer dereference in the matchat function in regexec.c in Oniguruma 6.9.2 allows attackers to potentially cause a denial of service by providing a crafted regular expression. Oniguruma vulnerabilities often affect Ruby, as well as common optional libraries used in PHP and Rust...
Astra Linux – Vulnerability in exim4
A vulnerability was discovered in Exim and has been classified as problematic. This issue affects certain aspects of the component Regex Handler’s processing. The vulnerability results in memory leaks after the component is freed from memory. The name of the patch is...
Astra Linux – Vulnerability in pcre2
A out-of-bounds read vulnerability was discovered in the PCRE2 library, specifically in the getrecursedatalength function of the pcre2jitcompile.c file. This issue affects recursions in JIT-compiled regular expressions due to duplicate data transfers...
Astra Linux – Vulnerability in node-ssri
ssri 5.2.2-8.0.0; fixed in 8.0.1. This version processes SRIs using a regular expression, which is vulnerable to a denial-of-service attack. Malicious SRIs could take an extremely long time to process, resulting in a denial of service. This issue only affects consumers who use the “strict” option...
Astra Linux – Vulnerability in sqlparse
sqlparse is a non-validation SQL parser module for Python. In affected versions, the SQL parser contains a regular expression that is vulnerable to ReDoS Regular Expression Denial of Service. This issue was introduced by the commit e75e358. The vulnerability may lead to Denial of Service DoS. Thi...
