CVE-2026-14741 HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parsedate. parsedate matches the date string against a chain of alternative regexes, and str2time delegates to it. Several of these patterns place unbounded quantifiers next to each other before a...

CVE-2026-14741

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parsedate. parsedate matches the date string against a chain of alternative regexes, and str2time delegates to it. Several of these patterns place unbounded quantifiers next to each other before a...

CVE-2026-14741 HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parsedate. parsedate matches the date string against a chain of alternative regexes, and str2time delegates to it. Several of these patterns place unbounded quantifiers next to each other before a...

CVE-2026-14741 HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parsedate. parsedate matches the date string against a chain of alternative regexes, and str2time delegates to it. Several of these patterns place unbounded quantifiers next to each other before a...

perl: Fix of 2 CVEs

CVE-2026-13221: regex trie construction in Sstudychunk stored the branch-to-tail delta in a 16-bit field; an alternation of more than 65535 fixed-string branches overflowed it and produced silently incorrect matches GH23388 — decline the trie optimization when the span would overflow -...

CVE-2026-62237

Grav before 2.0.4 contains a regular expression denial of service ReDoS vulnerability in the regexreplace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled security.twigcontent.processenabled: true, disabled by default, an...

CVE-2026-62237

CVE-2026-62237 affects Grav before 2.0.4. The vulnerability is a ReDoS in the regex_replace filter and function that are allowlisted in the Twig content sandbox. When Twig processing of page content is enabled (security.twig_content.process_enabled: true), an authenticated page editor can supply ...

CVE-2026-62237

Grav before 2.0.4 contains a regular expression denial of service ReDoS vulnerability in the regexreplace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled security.twigcontent.processenabled: true, disabled by default, an...

CVE-2026-62237 Grav < 2.0.4 ReDoS via regex_replace in Sandbox

Grav before 2.0.4 contains a regular expression denial of service ReDoS vulnerability in the regexreplace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled security.twigcontent.processenabled: true, disabled by default, an...

RabbitMQ 4.2.x < 4.2.4 MQTT Topic Authorization Bypass

The version of RabbitMQ installed on the remote host is 4.2.x prior to 4.2.4. It is, therefore, affected by an authorization bypass vulnerability: - RabbitMQ's MQTT plugin allows for topic-level authorization using regular expressions with variable substitution. However, the clientid is provided ...

CVE-2026-46378

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the selector lexer matchRegexPattern closure in Tokenizer.parseCurRune in selector/lexer/tokenize.go loops while tokenizing an unterminated regex literal such as r/ because...

DEBIAN-CVE-2026-46378

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the selector lexer matchRegexPattern closure in Tokenizer.parseCurRune in selector/lexer/tokenize.go loops while tokenizing an unterminated regex literal such as r/ because...

UBUNTU-CVE-2026-46378

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the selector lexer matchRegexPattern closure in Tokenizer.parseCurRune in selector/lexer/tokenize.go loops while tokenizing an unterminated regex literal such as r/ because...

CVE-2026-46378

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the selector lexer matchRegexPattern closure in Tokenizer.parseCurRune in selector/lexer/tokenize.go loops while tokenizing an unterminated regex literal such as r/ because...

SUSE CVE-2026-42533

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable i...

CVE-2026-46378

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the selector lexer matchRegexPattern closure in Tokenizer.parseCurRune in selector/lexer/tokenize.go loops while tokenizing an unterminated regex literal such as r/ because...

CVE-2026-46378 Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the selector lexer matchRegexPattern closure in Tokenizer.parseCurRune in selector/lexer/tokenize.go loops while tokenizing an unterminated regex literal such as r/ because...

CVE-2026-46378

Dasel (github.com/tomwright/dasel) is affected by CVE-2026-46378 due to a non-terminating loop in the selector lexer when tokenizing an unterminated regex literal (r/). The bug resides in matchRegexPattern inside selector/lexer/tokenize.go, where the loop continues indefinitely if the closing sla...

CVE-2026-46378 Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the selector lexer matchRegexPattern closure in Tokenizer.parseCurRune in selector/lexer/tokenize.go loops while tokenizing an unterminated regex literal such as r/ because...

CVE-2026-45367

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches, matchesFull, and replaceMatches to Java regex operations without effective timeouts,...