Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic wor...

CVE-2026-59922

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or c

历史摘要 · 未重新核验 · NVD

Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions

CVE-2026-59928

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repe

历史摘要 · 未重新核验 · OSV.dev

inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

CVE-2026-59925

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-ast

历史摘要 · 未重新核验 · OSV.dev

Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)

CVE-2026-59922

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or c

历史摘要 · 未重新核验 · OSV.dev

String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of...

CVE-2026-14895

String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. The trim and rtri

历史摘要 · 未重新核验 · GitHub Advisory

String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. The trim and rtrim functions stripped trailing whitespace with s/\s*$//u. ...

CVE-2026-14895

String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. The trim and rtri

历史摘要 · 未重新核验 · NVD

String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service

CVE-2026-14895

String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. The trim and rtri

历史摘要 · 未重新核验 · OSV.dev

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, the structured_outputs.regex API parameter passes a user-supplied regular ...

CVE-2026-55574

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, the structured_ou

历史摘要 · 未重新核验 · NVD

@asymmetric-effort/nogginlessdom vulnerable to ReDoS via user-controlled regex in HTMLInputElement pattern validation

## Summary The `HTMLInputElement.checkValidity()` method constructed a `RegExp` directly from the user-controlled `patt

历史摘要 · 未重新核验 · GitHub Advisory

jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion

CVE-2026-52746

### Impact In JSONata `= 2.2.0 via fixes that include https://github.com/jsonata-js/jsonata/pull/782 and https://github.

历史摘要 · 未重新核验 · GitHub Advisory

js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals

CVE-2026-49293

## Summary `js-toml` versions up to and including **1.1.0** parse hexadecimal / octal / binary integer literals via a h

历史摘要 · 未重新核验 · GitHub Advisory

Sentry is an error tracking and performance monitoring tool. From 24.4.0 until 26.5.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Sentry's event inge...

CVE-2026-52794

Sentry is an error tracking and performance monitoring tool. From 24.4.0 until 26.5.2, a Regular Expression Denial of Se

历史摘要 · 未重新核验 · NVD

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Deni...

CVE-2026-54268

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

历史摘要 · 未重新核验 · NVD

vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS)...

CVE-2025-71379

vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Severa

历史摘要 · 未重新核验 · GitHub Advisory

vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.py, the phi4mini to...

CVE-2025-71379

vLLM 版本 0.6.3 至 0.9.0（不含）存在多个正则表达式拒绝服务（ReDoS）漏洞。漏洞点位于 vllm/lora/utils.py 中的正则模式、phi4mini 工具解析器以及兼容 OpenAI 的服务聊天端点。这些正则表达

历史摘要 · 未重新核验 · NVD

js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. Versions up to and including 1.1.0 parse hexadecimal / octal / binary integer literals via a h...

CVE-2026-49293

js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. Versions up to and including 1.1.0 pa

历史摘要 · 未重新核验 · NVD

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the built-in strip_html filter uses a regex containing f...

CVE-2026-45617

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below,

历史摘要 · 未重新核验 · NVD

HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS

CVE-2026-55470

## Summary The fix for CVE-2026-45367 added `RegexTimeout` protection to the `matches()` function in DSTU2016MAY, DSTU3,

历史摘要 · 未重新核验 · GitHub Advisory

UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`

CVE-2026-48125

### Summary A regular expression denial-of-service (ReDoS) vulnerability has been discovered in `ua-parser-js` when usi

历史摘要 · 未重新核验 · GitHub Advisory

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.77 and 9.9.1-alpha.1, an unauthenticated attacker w...

CVE-2026-47138

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

历史摘要 · 未重新核验 · NVD