CVE-2026-96292

A flaw was found in Apache Thrift's Lua bindings. A remote attacker could exploit this vulnerability by sending specially crafted input that triggers inefficient regular expression processing. This can cause excessive resource consumption, resulting in a Denial of Service DoS on the affected...

regexploit

Regexploit Find regexes which are vulnerable to Regular Expression Denial of Service ReDoS. More info onthe Doyensec blog Many default regular expression parsers have unbounded worst-case complexity. Regex matching may be quick when presented with a matching input string. However, certain...

regexploit

Regexploit Trouvez les regex vulnérables au déni de service par expression régulière ReDoS. Plus d'informations surle blog de Doyensec De nombreux analyseurs d'expressions régulières par défaut ont une complexité dans le pire des cas illimitée. La correspondance d'une regex peut être rapide lorsq...

domain_analyzer

Domain Analyzer v0.8.3 What Domain analyzer is a security analysis tool that automatically discovers and reports information about a given domain. Its main purpose is to analyze domains in an unattended way. It has many crazy features, such as getting more domains from DNS zones, automatic nmap,...

CVE-2026-104861

probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parsesync/svg.js and lib/parsestream/svg.js use the searching regular expression //, which repeatedly scans to the end of input when attacker-controlled data contains many less-than characters without ...

CVE-2026-104861

The probe-image-size library (versions <= 7.3.0) is vulnerable to a quadratic-time Denial of Service (DoS) attack due to inefficient regular expression handling in its SVG parser. Specifically, the regex /]*>/ causes the engine to repeatedly scan to the end of the input whenever it encounte...

jsfinder

Features | Installation | Usage | Demo | TODOs| Contact jsFinder is a command-line tool written in Go that scans web pages to find JavaScript files linked in the HTML source code. It searches for any attribute that can contain a JavaScript file e.g., src, href, data-main, etc. and extracts the UR...

CVE-2026-67989

crmne/rubyllm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in Mistral model capability matching on Ruby 3.1.x...

warcannon

WARCannon - Catastrophically powerful parallel WARC processing WARCannon was built to simplify and cheapify the process of 'grepping the internet'. With WARCannon, you can: Build and test regex patterns against real Common Crawl data Easily load Common Crawl datasets for parallel processing Scale...

bucky

Project is on temporary hold. Bucky Bucky is an automatic tool designed to discover S3 bucket misconfiguration, Bucky consists up of two modules Bucky firefox addon and Bucky backend engine. Bucky addon reads the source code of the webpages and uses Regular ExpressionRegex to match the S3 bucket...

CVE-2026-96292

Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

axios: Axios: Denial of Service via malformed data URLs

A flaw was found in Axios. A remote attacker can exploit this vulnerability by supplying a crafted data URL containing repeated slash characters to an application that processes untrusted inputs. Due to an inefficient regular expression used to parse the URL, handling the malformed input triggers...

axios: Axios: Denial of Service via malformed data URLs

A flaw was found in Axios. A remote attacker can exploit this vulnerability by supplying a crafted data URL containing repeated slash characters to an application that processes untrusted inputs. Due to an inefficient regular expression used to parse the URL, handling the malformed input triggers...

anteater

Anteater - CI/CD Gate Check Framework Description Anteater is an open framework to prevent the unwanted merging of nominated strings, filenames, binaries, depreciated functions, staging enviroment code / credentials etc. Anything that can be specified with regular expression syntax, can be sniffe...

CVE-2026-77387

A flaw was found in geopy. An attacker can cause a Denial of Service DoS by supplying excessively long or malformed coordinate strings to coordinate parsing functions such as Point.fromstring or reverse geocoding methods. Due to inefficient regular expression evaluation on unvalidated input,...

ROS-20261002-73-0070

The vulnerability of regular expression functions in the PostgreSQL database management system is related to buffer overflows in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-77387

geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.fromstring can spend excessive CPU time due to inefficient regular-expression behavior when an application passes a long malformed coordinate string without the 256-character input limit used by the fix. Geocoder rever...

ROS-20261002-73-0068

The vulnerability of regular expression functions in the PostgreSQL database management system is related to buffer overflows in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20261002-73-0066

The vulnerability of regular expression functions in the PostgreSQL database management system is related to buffer overflows in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20261002-73-0069

The vulnerability of regular expression functions in the PostgreSQL database management system is related to buffer overflows in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...