npm s3-url-parser 安全漏洞

npm s3-url-parser is a library from npm USA. It is used to bring up information from S3 URLs in any format. A security vulnerability exists in npm s3-url-parser version 1.0.3, which stems from the application's vulnerability to denial-of-service attacks with regular expression components...

perl: Write past buffer end via illegal user-defined Unicode property

A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer...

PT-2024-5144 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.5 through 16.9.5 GitLab CE/EE versions 16.10 through 16.10.3 GitLab CE/EE versions 16.11 through 16.11.0 Description: An issue has been discovered in GitLab CE/EE where a crafted wildcard filter in FileFinder may lead...

pygments: ReDoS in pygments

A denial-of-service vulnerability related to regular expressions was discovered in Pygments, specifically in the file pygments/lexers/smithy.py. An attacker could exploit this flaw by sending a carefully crafted request, leading to a denial-of-service situation...

python-django: Denial-of-service possibility in django.utils.text.Truncator

An inefficient regular expression complexity was found in Django. The text truncator regular expressions exhibit linear backtracking complexity, which can be slow, leading to a potential denial of service, given certain HTML inputs...

PT-2024-5856

Name of the Vulnerable Software and Affected Versions Pydantic versions prior to 2.4.0 Pydantic versions prior to 1.10.13 Description The issue is related to the use of regular expressions in the Pydantic library, which can lead to a denial of service when exploited by a remote attacker. This can...

SheetJS 安全漏洞

SheetJS is a software application. A parser and writer for various spreadsheet formats. A security vulnerability exists in SheetJS Community Edition prior to version 0.20.2 that stems from vulnerability to regular expression denial of service attacks...

python-django: Denial-of-service possibility in django.utils.text.Truncator

An inefficient regular expression complexity was found in Django. The text truncator regular expressions exhibit linear backtracking complexity, which can be slow, leading to a potential denial of service, given certain HTML inputs...

PT-2024-40670 · Pcre2 · Pcre2

Name of the Vulnerable Software and Affected Versions: PCRE2 affected versions not specified Description: A heap buffer overflow read issue has been identified. The crash occurs in the pcre2 fuzzsupport.c file, specifically due to a heap-buffer-overflow read of 4 bytes. Recommendations: At the...

django-wiki Security Vulnerabilities

django-wiki is a wiki system based on Django. A security vulnerability exists in versions of django-wiki prior to 0.10.1, which stems from vulnerability to maliciously crafted article content that could lead to a denial of service via regular expressions...

Fedora: Security Advisory for jakarta-oro (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: jakarta-oro-2.0.8-44.fc40

The Jakarta-ORO Java classes are a set of text-processing Java classes that provide Perl5 compatible regular expressions, AWK-like regular expressions, glob expressions, and utility classes for performing substitutions, splits, filtering filenames, etc. This library is the successor to the...

BIT-GOLANG-2022-41715 Memory exhaustion when compiling regular expressions in regexp/syntax

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consu...

BIT-MODSECURITY2-2020-15598

Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing our claims." The CVE suggests that there is a security issue with how ModSecurity handles regular expressions that can result in a Denial...

BIT-MODSECURITY-2020-15598

Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing our claims." The CVE suggests that there is a security issue with how ModSecurity handles regular expressions that can result in a Denial...

pygments: ReDoS in pygments

A denial-of-service vulnerability related to regular expressions was discovered in Pygments, specifically in the file pygments/lexers/smithy.py. An attacker could exploit this flaw by sending a carefully crafted request, leading to a denial-of-service situation...

Code injection

Parts of the Scrapy API were found to be vulnerable to a ReDoS attack. Handling a malicious response could cause extreme CPU and memory usage during the parsing of its content, due to the use of vulnerable regular expressions for that parsing...

CVE-2024-1892

CVE-2024-1892 is a ReDoS vulnerability in Scrapy’s XMLFeedSpider class during XML parsing. The issue arises from inefficient regular expressions used in parsing XML content, enabling an attacker to cause a denial-of-service by crafting malicious XML that can exhaust CPU and memory, potentially ma...

Scrapy Security Vulnerabilities

Scrapy is a free and open source web crawler framework written in Python. A security vulnerability exists in Scrapy that stems from the use of vulnerable regular expressions for parsing, where processing a malicious response may result in extreme CPU and memory usage during parsing of its content...

ALSA-2024:0889 Moderate: oniguruma security update

Oniguruma is a regular expressions library that supports a variety of character encodings. Security Fixes: oniguruma: Use-after-free in onignewdeluxe in regext.c CVE-2019-13224 oniguruma: Stack exhaustion in regcomp.c because of recursion in regparse.c CVE-2019-16163 oniguruma: integer overflow i...