#cwe-1333

共收录 223 条相关情报。

漏洞预警2026-11-01 发布MEDIUM

A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file loguru/_colorizer.py of the component ANSI Color-Markup Par...

CVE-2026-120217

A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file lo

来源摘录 · NVD

#cve #cwe-1333 #cwe-400

安全公告2026-10-30 发布HIGH

joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

CVE-2026-118772

### Summary `Joi.string().email({ multiple: true })` takes quadratic time to split a value that contains a long run of

来源摘录 · GitHub Advisory

#advisory #cwe-1333 #npm #severity:high

安全公告2026-10-30 发布HIGH

@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

CVE-2026-119202

### Summary `Content.disposition()` takes quadratic time when a `Content-Disposition` parameter contains a long token w

来源摘录 · GitHub Advisory

#advisory #cwe-1333 #npm #severity:high

安全公告2026-10-30 发布HIGH

Forge: Regular expression denial of service in PEM decoding (pem.decode)

CVE-2026-118779

### Summary `pem.decode()`, which every node-forge API that parses PEM input uses, split messages with a regular express

来源摘录 · GitHub Advisory

#advisory #cwe-1333 #cwe-400 #npm #severity:high

漏洞预警2026-10-30 发布HIGH

Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. Prior to 1.15.5, `wrap-nested-params` in the `ring.middleware.nested-params` namespace uses...

CVE-2026-62864

Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. Prior to 1.15.5, `wrap-nested-para

来源摘录 · NVD

#cve #cwe-1333

漏洞预警2026-10-30 发布MEDIUM

Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js p...

CVE-2026-119300

Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.

来源摘录 · NVD

#cve #cwe-1333

漏洞预警2026-10-30 发布INFO

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The before_dispatch h...

CVE-2026-118993

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expre

来源摘录 · NVD

#cve #cwe-1333

漏洞预警2026-10-30 发布INFO

Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a...

CVE-2026-115866

Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding c

来源摘录 · NVD

#cve #cwe-1333

漏洞预警2026-10-29 发布HIGH

@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression s...

CVE-2026-119202

@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored p

来源摘录 · NVD / GitHub Advisory / OSV.dev

#advisory #cve #cwe-1333 #npm #severity:high

漏洞预警2026-10-29 发布HIGH

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, m...

CVE-2026-118779

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-1333 #cwe-400 #npm #severity:high

漏洞预警2026-10-29 发布HIGH

joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator re...

CVE-2026-118772

joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.st

来源摘录 · NVD / GitHub Advisory / OSV.dev

#advisory #cve #cwe-1333 #npm #severity:high

漏洞预警2026-10-28 发布HIGH

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling cons...

CVE-2026-118686

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-1333 #severity:high

漏洞预警2026-10-28 发布MEDIUM

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows authenticated members to block the event loop via crafted glob ...

CVE-2026-118646

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows authen

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-1333 #severity:high

漏洞预警2026-10-28 发布MEDIUM

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.67.0, W3CTraceCont...

CVE-2026-118259

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing tel

来源摘录 · NVD

#cve #cwe-1333

漏洞预警2026-10-28 发布INFO

HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart parser finds t...

CVE-2026-117500

HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart u

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-1333

漏洞预警2026-10-28 发布HIGH

RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching thr...

CVE-2026-116795

RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.

来源摘录 · NVD

#cve #cwe-1333 #cwe-407

漏洞预警2026-10-28 发布INFO

HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In chunked mode, used when no content len...

CVE-2026-116285

HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked r

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-1333

漏洞预警2026-10-28 发布INFO

MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters. The comment pattern used to parse Content-Type and Content...

CVE-2026-116268

MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters. T

来源摘录 · NVD

#cve #cwe-1333

漏洞预警2026-10-28 发布INFO

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, unchecked loop condition and inefficient regular express...

CVE-2026-118037

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop,

历史摘要 · 未重新核验 · NVD

#cve #cwe-1333 #cwe-606 #cwe-674 #cwe-835

漏洞预警2026-10-27 发布INFO

dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on a...

CVE-2026-116693

dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QU

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-1333