CVE-2026-70656 Checkmate: Regular Expression Denial of Service (ReDoS) via User-Controlled Regex in Monitor Advanced Matching

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.5.1 until 3.9.2, an authenticated admin or superadmin can set matchMethod to regex and place a malicious expression...

python: Python: Denial of Service via super-linear regular expression work in csv.Sniffer.sniff()

A flaw was found in the csv.Sniffer.sniff function within Python. An attacker can exploit this by providing specially crafted CSV samples, which can trigger super-linear regular-expression processing during dialect sniffing. This excessive processing consumes significant CPU resources, potentiall...

GHSA-QX2G-XRX7-VFH8 NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...

PT-2026-79501

Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys. The FETCH, EXISTS and DELETE methods throw an exception when on malformed regular expressions. Each method falls back to a regex match when the key is not already stored in the hash, compiling the...

DEBIAN-CVE-2026-72818

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...

CVE-2026-72818

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...

CVE-2026-72818

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...

UBUNTU-CVE-2026-72818

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...

CVE-2026-72818 NLTK TweetTokenizer URL Pattern Backtracks Catastrophically on Naked-Domain-Like Input

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...

CVE-2026-72818 NLTK TweetTokenizer URL Pattern Backtracks Catastrophically on Naked-Domain-Like Input

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...

CVE-2026-72818

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...

GHSA-2P39-2JF3-FV2Q next-video: Unauthenticated arbitrary file read via /api/video request handler

Impact The HTTP route handler exported by next-video/request-handler — which the README instructs consumers to mount at /api/video — allows an unauthenticated remote attacker to read arbitrary .json files from the production filesystem of any application following the documented setup. The...

CVE-2026-77082

n8n before 1.123.69 , 2.x before 2.33.4 , and 2.34.x before 2.34.1 is affected by a ReDoS vulnerability in the Filter and Switch nodes . The root cause is that user-supplied regex patterns are compiled with new RegExp() and executed synchronously on the worker thread without complexity validation...

CVE-2026-77082 n8n before 1.123.69 ReDoS via Filter and Switch Node

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service ReDoS vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp and execute them synchronously on the worker thread without complexity...

CVE-2026-77082 n8n before 1.123.69 ReDoS via Filter and Switch Node

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service ReDoS vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp and execute them synchronously on the worker thread without complexity...

CVE-2026-77082 n8n before 1.123.69 ReDoS via Filter and Switch Node

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service ReDoS vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp and execute them synchronously on the worker thread without complexity...

OESA-2026-3425 perl security update

Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects. Security Fixes: Perl versions through 5.45.1 have...

The vulnerability of regular expression functions in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of regular expression functions in the PostgreSQL database management system is related to buffer overflows in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-79260

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.1 Description The URLS regular expression in nltk/tokenize/casual.py, which is compiled into TweetTokenizer.WORD RE and used by TweetTokenizer.tokenize, contains an unbounded domain-label prefix. When processing inp...

PT-2026-78937

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions 2.x prior to 2.33.4 n8n versions 2.34.x prior to 2.34.1 Description A regular expression denial of service ReDoS exists in the Filter and Switch nodes. The issue occurs because user-supplied regex...