CVE-2026-67991

crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in RubyLLM::Utils.underscore on Ruby 3.1.x. A very long crafted class, agent, or tool name can cause excessive CPU consumption and a denial of service...

CVE-2026-67991

CVE-2026-67991 affects crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83, where RubyLLM::Utils.underscore contains a polynomial-time regular expression denial-of-service condition on Ruby 3.1.x. A very long crafted class, agent, or tool name can cause excessive CPU consumption and...

PT-2026-71671

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured outputs.regex parameter in vllm/v1/structured output/backend lm format enforcer.py is passed to lmformatenforcer.RegexParser without compile regex with timeout or validation in validate structured...

CVE-2026-67991

crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in RubyLLM::Utils.underscore on Ruby 3.1.x. A very long crafted class, agent, or tool name can cause excessive CPU consumption and a denial of service...

PT-2026-71683

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S find byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...

Linux Distros Unpatched Vulnerability : CVE-2026-18503

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass...

CVE-2026-73425 @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remoteimages for Netlify's Image CDN allowlist. In...

CVE-2026-73425

CVE-2026-73425 affects Astro with the Netlify adapter prior to 8.1.2. The root cause is in remotePatternToRegex: dots in hostnames are escaped, but pathname metacharacters (., +, ?, (, [) are not escaped, so a restrictive pathname like /img/v1.0/file can match unintended paths. Netlify enforces t...

CVE-2026-73425 @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remoteimages for Netlify's Image CDN allowlist. In...

PT-2026-71340

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remote images for Netlify's Image CDN allowlist. In...

Security Bulletin:Vulnerability in Perl affects IBM Netezza Appliance

Summary The Perl package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-8376 Vulnerability Details CVEID:CVE-2026-8376 DESCRIPTION: Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed...

CVE-2026-72912

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed recipe= URL fragment containing a large number of unmatched quote characters reaches...

CVE-2026-72912

CVE-2026-72912 affects CyberChef (web app). The vulnerability lies in the pretty-recipe parser in src/core/Utils.mjs, where a malformed #recipe= URL fragment with many unmatched quote characters triggers a heavy backtracking path in a complex global regular expression. This causes client-side CPU...

CVE-2026-72912

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed recipe= URL fragment containing a large number of unmatched quote characters reaches...

openjdk: Enhance XBM image support (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The regex defined in XbmImageDecoder matchRegex is vulnerable to a DoS attack when the input contains a long string without a closing character; due to excessive backtracking...

openjdk: Enhance XBM image support (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The regex defined in XbmImageDecoder matchRegex is vulnerable to a DoS attack when the input contains a long string without a closing character; due to excessive backtracking...

Security update for perl-Date-Manip

This update for perl-Date-Manip fixes the following issues: CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check bsc1273063. CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution in...

CVE-2026-18503

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

CVE-2026-18503 Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

EUVD-2026-55630

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...