CVE-2023-22796

CVE-2023-22796 affects Ruby on Rails’ Active Support gem. A regex-based DoS vulnerability (catastrophic backtracking) can cause high CPU and memory usage when the underscore method is fed a crafted string, leading to a DoS. Affected: Active Support versions <6.1.7.1 and

CVE-2023-22792

CVE-2023-22792 affects Rails Action Dispatch: vulnerable in Action Dispatch <6.0.6.1, <6.1.7.1, and

CVE-2023-22796

A regular expression based DoS vulnerability in Active Support 6.1.7.1 and 7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory,...

CVE-2023-22795

A regular expression based DoS vulnerability in Action Dispatch 6.1.7.1 and 7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This...

CVE-2023-22792

A regular expression based DoS vulnerability in Action Dispatch 6.0.6.1, 6.1.7.1, and 7.0.4.1. Specially crafted cookies, in combination with a specially crafted XFORWARDEDHOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process...

GHSA-C2JC-4FPR-4VHG @sideway/formula contains Regular Expression Denial of Service (ReDoS) Vulnerability

Impact User-provided strings to formula's parser might lead to polynomial execution time. Patches Users should upgrade to 3.0.1+. Workarounds None...

CVE-2023-25167

Discourse is an open source discussion platform. In affected versions a malicious user can cause a regular expression denial of service using a carefully crafted git URL. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. There a...

CVE-2023-25167 Regular expression denial of service via installing themes via git in discourse

Discourse is an open source discussion platform. In affected versions a malicious user can cause a regular expression denial of service using a carefully crafted git URL. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. There a...

CVE-2023-25167 Regular expression denial of service via installing themes via git in discourse

Discourse is an open source discussion platform. In affected versions a malicious user can cause a regular expression denial of service using a carefully crafted git URL. This issue is patched in the latest stable, beta and tests-passed versions of Discourse. Users are advised to upgrade. There a...

Regular Expression Denial of Service (ReDoS)

Overview deno is an a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to the upgradeWebSocket function, which contains regexes in the form of /s,s/...

Regular Expression Denial Of Service (ReDoS)

http-cache-semantics is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability exists in the index.js because of insufficient regular expression complexity which allows an attacker to cause an application crash...

PT-2023-19952 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest stable, beta and tests-passed versions Description: Discourse is an open source discussion platform. A malicious user can cause a regular expression denial of service using a carefully crafted git URL...

Discourse security vulnerabilities

Discourse is an open source community discussion platform. The platform includes features such as communities, email and chat rooms. Discourse suffers from a security vulnerability that stems from the fact that a malicious user can use a crafted git URL to cause a regular expression denial of...

Security Bulletin: Denial of Service vulnerability affects IBM Business Automation Workflow - CVE-2022-25887

Summary IBM Business Automation Workflow is vulnerable to a Denial of Service attack. Vulnerability Details CVEID:CVE-2022-25887 DESCRIPTION: Node.js sanitize-html module is vulnerable to a denial of service, caused by insecure global regular expression replacement logic of HTML comment removal. ...

MGASA-2023-0036 Updated python-mechanize packages fix security vulnerability

Denial of service via crafted regular expression CVE-2021-32837 Fixed mechanize not found during build...

Updated python-mechanize packages fix security vulnerability

Denial of service via crafted regular expression CVE-2021-32837 Fixed mechanize not found during build...

glob-parent: Regular Expression Denial of Service

A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service ReDoS attacks, affecting system availability...

nodejs-minimatch: ReDoS via the braceExpand function

A vulnerability was found in the nodejs-minimatch package. This flaw allows a Regular Expression Denial of Service ReDoS when calling the braceExpand function with specific arguments, resulting in a Denial of Service...

CVE-2018-25079

A flaw was found in the is-url package. The manipulation leads to inefficient regular expression complexity...

USN-5816-2: Firefox regressions

USN-5816-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Niklas Baumstark discovered that a compromised web child process of Firefox could disable web security openin...