dd-trace: ReDOS in URL query string obfuscation
CVE-2026-116693
### Summary A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain
#cwe-1333
共收录 223 条相关情报。
← 返回所有主题Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
CVE-2026-108082
### Description `HeaderUtils::split()` parsed header values with a pattern whose token alternative also matched whitesp
Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtrack...
CVE-2026-116588
Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfus
Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking...
CVE-2026-115822
Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked reque
GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts ...
CVE-2026-115887
GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until
Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability...
CVE-2026-115508
Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server
Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounde...
CVE-2026-115508
Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server
OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, re...
CVE-2026-114603
OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function
Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
CVE-2026-112901
``` ============================================================================ ReDoS in XbmImagePlugin: 512-byte file
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression denial of service. In XbmImageFile._open, when an application...
CVE-2026-112901
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular-expression deni
A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function _sectionmarker of the file configobj/__init__.py. The manipulation...
CVE-2026-112300
A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function _sectionm
ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity,...
CVE-2026-111997
ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) v
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection...
CVE-2026-110869
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUT
GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the...
CVE-2026-110856
GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can s...
CVE-2026-109563
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that bac
Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patter...
CVE-2026-109295
Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authentic
Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop
CVE-2026-109295
Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authentic
Satel Netco Design versions prior to v2.1.7 contains an inefficient regular expression complexity...
CVE-2026-104628
Satel Netco Design versions prior to v2.1.7 contains an inefficient regular expression complexity vulnerability. An auth
Satel Netco Design versions prior to v2.1.7 contains an inefficient regular expression complexity vulnerability. An authenticated user with Viewer privileges could submit crafte...
CVE-2026-104628
Satel Netco Design versions prior to v2.1.7 contains an inefficient regular expression complexity vulnerability. An auth
Ghost: Regular Expression Denial of Service in External Media Inliner
CVE-2026-105645
### Impact A crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unr