JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable
CVE-2026-77420
### Summary The JLine3 `HISTORY_IGNORE` variable is converted into a Java regular expression with only partial escaping
#cwe-1333
共收录 223 条相关情报。
← 返回所有主题JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable
CVE-2026-77420
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(Str
JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping
CVE-2026-77422
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command
JLine: ReDoS in Nano Editor Regex Search Mode
CVE-2026-77421
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's
NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[0-9]+([eE][+-]?[0-...
CVE-2026-89407
NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expres
jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS
CVE-2026-89407
NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expres
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string i...
CVE-2026-58270
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0,
An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive proce...
CVE-2026-93761
An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library ma
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns
CVE-2026-86000
## Summary soupsieve compiles CSS selector strings with a set of hand-written regular expressions. The shared `IDENTIFI
Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)
CVE-2026-85999
## Summary Before tokenizing, `selector_iter` trims leading/trailing whitespace and comments by running two regexes ove
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/css_parser.py defines IDENTIFIER with adjacent...
CVE-2026-86000
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selector_iter in src/soupsieve/css_parser.py trims the raw selector with RE_WS_END,...
CVE-2026-85999
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selector_iter in src/soups
Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking patt...
CVE-2026-63460
Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthentica
joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable...
CVE-2026-92599
joi (npm package `joi`, hapi.js) versions >=17.2.0 =18.0.0 <18.2.6 are vulnerable to regular expression denial of servic
A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/web_core/src/v0_9/basic_catalog/functions/safe_regex.ts o...
CVE-2026-92114
A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260706.0, the JSON ingestion mapper's extractWithRegexp formula f...
CVE-2026-76821
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260706.0
The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER.URL - contain ambi...
CVE-2026-82617
The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FIND
jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newD...
CVE-2026-68497
jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field b
An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation during message delivery attempts, occupyin...
CVE-2026-75880
An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excess
Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing
## Summary `@tiptap/core` contains two quadratic regular-expression denial-of-service paths in its default Markdown att