Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
CVE-2026-69207
### Summary The built-in CORS middleware (`hono/cors`) parses the attacker-controlled `Access-Control-Request-Headers`
#cwe-1333
共收录 223 条相关情报。
← 返回所有主题Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot
CVE-2026-53500
## Summary The `ALLOWED_SOURCES` configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images
Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex
CVE-2026-12061
### Summary `ReviewsCorpusReader` extracts feature annotations of the form *label* followed by a bracketed signed digit
Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When someone provide the proper string it ca...
CVE-2026-16270
Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex
ReDoS in Open Mercato
CVE-2026-16270
Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex
Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
CVE-2026-58436
### Summary The Locale middleware that runs in front of every unauthenticated request calls `golang.org/x/text/language
Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)
CVE-2026-59922
## Summary **Type:** Algorithmic-complexity denial of service. A run of N closed pairs `~~x~~~~x~~...` (or the analogou
Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs
CVE-2026-59925
## Summary **Type:** Algorithmic-complexity DoS in core emphasis parsing. A long sequence of well-formed `**x**` (stron
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept...
CVE-2026-49485
CVE-2026-49485 是 HAPI FHIR 库中的一个拒绝服务漏洞。HAPI FHIR 是基于 Java 的 HL7 FHIR 标准完整实现，用于医疗保健互操作性。该漏洞影响 6.9.9 和 6.9.4.2 之前的所有版本。漏洞根
JSONata is a JSON query and transformation language. Prior to 2.2.0, malicious non-matching inputs to the $toMillis function can cause superlinear backtracking in the ISO-8601 v...
CVE-2026-52746
JSONata is a JSON query and transformation language. Prior to 2.2.0, malicious non-matching inputs to the $toMillis func
JSONata: Malicious inputs to "$toMillis" function can cause resource exhaustion
CVE-2026-52746
JSONata is a JSON query and transformation language. Prior to 2.2.0, malicious non-matching inputs to the $toMillis func
vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends
CVE-2026-55574
## Summary The `structured_outputs.regex` API parameter passes a user-supplied regex string directly to grammar compile
HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date. parse_date() matches the date string against a chain of alternati...
CVE-2026-14741
HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date. parse_da
HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date
CVE-2026-14741
HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date. parse_da
Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the...
CVE-2026-62237
Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and
Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and function, which are allowlisted in the Twig content sandb...
CVE-2026-62237
Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and
Grav < 2.0.4 ReDoS via regex_replace in Sandbox
CVE-2026-62237
Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled...
CVE-2026-45367
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7,
HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
CVE-2026-45367
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7,
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to ...
CVE-2026-49477
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser