Ghost: Regular Expression Denial of Service in Content Import
CVE-2026-105646
### Impact A crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploit
#cwe-1333
共收录 223 条相关情报。
← 返回所有主题Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardToRegexp() in twisted/mail/imap4.py translates the IMAP ast...
CVE-2026-106454
Twisted is an event-based framework for internet applications, supporting Python 3.6+. In 25.5.0 and earlier, wildcardTo
Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK functi...
CVE-2026-102408
Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expressi
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMa...
CVE-2026-106104
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart requ...
CVE-2026-105854
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary ve
Payload: ReDoS in Multipart Content-Type Validation
CVE-2026-105854
## Impact A malformed multipart request body could take an extremely long time to finish. ## Patches Users should upgra
Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Explo...
CVE-2026-105646
Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessi
Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server ...
CVE-2026-105645
Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner
Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in...
CVE-2026-105219
Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser
Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping rege...
CVE-2026-105219
Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser
Mammoth.js 1.3.0 before 1.12.3 ReDoS via Style Map Tokeniser
CVE-2026-105219
Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser
probe-image-size: Quadratic-time Denial of Service in the SVG Parser
CVE-2026-104861
## Overview `probe-image-size` scans the SVG header with a searching regular expression, `/]*>/`. On input that contain
geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point
CVE-2026-77387
### Impact `geopy.Point` and `Point.from_string()` may take excessive CPU time when parsing long, malformed coordinate
probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parse_sync/svg.js and lib/parse_stream/svg.js use the searching regular expressio...
CVE-2026-104861
probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parse_sync/svg.js and li
probe-image-size: Quadratic-time Denial of Service in the SVG Parser
CVE-2026-104861
probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parse_sync/svg.js and li
crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in Mistral model capability matching ...
CVE-2026-67989
crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-o
Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. ...
CVE-2026-96292
Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua binding
YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) markdown-link regex. Unauthenticated attackers can submit a...
CVE-2026-104454
YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) ma
YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint
CVE-2026-104454
YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) ma
geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.from_string() can spend excessive CPU time due to inefficient regular-expression behavior when an ...
CVE-2026-77387
geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.from_string() can spend excessive CPU tim