Common Weakness Enumeration

CWE-1333

Allowed

Inefficient Regular Expression Complexity

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

418 vulnerabilities reference this CWE, most recent first.

CVE-2026-116693 (GCVE-0-2026-116693)

Vulnerability from cvelistv5 – Published: 2026-10-27 20:07 – Updated: 2026-10-30 19:25
VLAI
Title
dd-trace: ReDOS in URL query string obfuscation
Summary
dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the instrumented application unavailable. This issue is fixed in versions 5.131.1 and 6.20.1.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 19:25 UTC
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
GitHub_M CNA
References
Impacted products
Vendor Product Version
DataDog dd-trace-js Affected: >= 2.0.0, < 5.131.1
Affected: >= 6.0.0, < 6.20.1
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116693",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T19:25:49.800441Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T19:25:57.583Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dd-trace-js",
          "vendor": "DataDog",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 5.131.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.20.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is applied synchronously while recording HTTP URL metadata, allowing a crafted request to consume excessive CPU, stall request processing, and make the instrumented application unavailable. This issue is fixed in versions 5.131.1 and 6.20.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T20:07:01.195Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-x94g-w73q-hpcw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/DataDog/dd-trace-js/security/advisories/GHSA-x94g-w73q-hpcw"
        },
        {
          "name": "https://github.com/DataDog/dd-trace-js/pull/10675",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DataDog/dd-trace-js/pull/10675"
        },
        {
          "name": "https://github.com/DataDog/dd-trace-js/commit/5eeee790c93036a50549056fc890028cb4c86b1b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DataDog/dd-trace-js/commit/5eeee790c93036a50549056fc890028cb4c86b1b"
        },
        {
          "name": "https://github.com/DataDog/dd-trace-js/commit/cf4e68a45fa1442c9850f2086c81901258e821b8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DataDog/dd-trace-js/commit/cf4e68a45fa1442c9850f2086c81901258e821b8"
        },
        {
          "name": "https://github.com/DataDog/dd-trace-js/releases/tag/v5.131.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DataDog/dd-trace-js/releases/tag/v5.131.1"
        },
        {
          "name": "https://github.com/DataDog/dd-trace-js/releases/tag/v6.20.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DataDog/dd-trace-js/releases/tag/v6.20.1"
        }
      ],
      "source": {
        "advisory": "GHSA-x94g-w73q-hpcw",
        "discovery": "UNKNOWN"
      },
      "title": "dd-trace: ReDOS in URL query string obfuscation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-116693",
    "datePublished": "2026-10-27T20:07:01.195Z",
    "dateReserved": "2026-10-26T20:00:59.830Z",
    "dateUpdated": "2026-10-30T19:25:57.583Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116588 (GCVE-0-2026-116588)

Vulnerability from cvelistv5 – Published: 2026-10-26 21:22 – Updated: 2026-11-02 18:14
VLAI
Title
Datadog dd-trace-py: ReDOS in URL query string obfuscation
Summary
Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 18:13 UTC
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
GitHub_M CNA
References
Impacted products
Vendor Product Version
DataDog dd-trace-py Affected: >= 1.5.0, < 3.19.9
Affected: >= 4.0.0, < 4.15.6
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116588",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T18:13:55.370431Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T18:14:38.663Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dd-trace-py",
          "vendor": "DataDog",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.5.0, \u003c 3.19.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.15.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the default query-string obfuscation regular expression can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability in affected HTTP tracing integrations that include query strings in URL span tags. The vulnerable processing is enabled by default for those integrations. This issue is fixed in versions 3.19.9 and 4.15.6."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T21:22:46.130Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-3633-r77q-h3v3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/DataDog/dd-trace-py/security/advisories/GHSA-3633-r77q-h3v3"
        },
        {
          "name": "https://github.com/DataDog/dd-trace-py/pull/20857",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DataDog/dd-trace-py/pull/20857"
        },
        {
          "name": "https://github.com/DataDog/dd-trace-py/pull/20862",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DataDog/dd-trace-py/pull/20862"
        },
        {
          "name": "https://github.com/DataDog/dd-trace-py/pull/20880",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DataDog/dd-trace-py/pull/20880"
        },
        {
          "name": "https://github.com/DataDog/dd-trace-py/commit/63ddc3cb07d8813ded7a8b3ab5b8d0f5470e4bfd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DataDog/dd-trace-py/commit/63ddc3cb07d8813ded7a8b3ab5b8d0f5470e4bfd"
        },
        {
          "name": "https://github.com/DataDog/dd-trace-py/commit/83ea39845dd95bfb9b8e247c62b3d22fc5dce1ce",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DataDog/dd-trace-py/commit/83ea39845dd95bfb9b8e247c62b3d22fc5dce1ce"
        },
        {
          "name": "https://github.com/DataDog/dd-trace-py/commit/a6d73607ea45ecd67152630f64b0945556972ed8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DataDog/dd-trace-py/commit/a6d73607ea45ecd67152630f64b0945556972ed8"
        },
        {
          "name": "https://github.com/DataDog/dd-trace-py/releases/tag/v3.19.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DataDog/dd-trace-py/releases/tag/v3.19.9"
        },
        {
          "name": "https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DataDog/dd-trace-py/releases/tag/v4.15.6"
        }
      ],
      "source": {
        "advisory": "GHSA-3633-r77q-h3v3",
        "discovery": "UNKNOWN"
      },
      "title": "Datadog dd-trace-py: ReDOS in URL query string obfuscation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-116588",
    "datePublished": "2026-10-26T21:22:46.130Z",
    "dateReserved": "2026-10-26T15:03:39.036Z",
    "dateUpdated": "2026-11-02T18:14:38.663Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116285 (GCVE-0-2026-116285)

Vulnerability from cvelistv5 – Published: 2026-10-28 17:16 – Updated: 2026-11-05 21:01
VLAI
Title
HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies
Summary
HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In chunked mode, used when no content length is given, add() matches each chunk-size line with `/^([\da-fA-F]+).*\x0D\x0A/`. On a line of hex digits whose first LF has no CR before it, the digits and `.*` backtrack against each other, so a single add() takes time quadratic in the line's length. Nothing limits how long the line can be. A remote attacker can exhaust CPU in applications that pass chunked request bodies to HTTP::Body.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:01 UTC
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
CPANSec CNA
References
Impacted products
Vendor Product Version
Affected: 0 , < 1.23_01 (custom)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-116285",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T21:01:31.352390Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T21:01:35.355Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "HTTP::Body"
          ],
          "packageName": "HTTP-Body",
          "packageURL": "pkg:cpan/HTTP-Body",
          "programFiles": [
            "lib/HTTP/Body.pm"
          ],
          "programRoutines": [
            {
              "name": "HTTP::Body::add"
            }
          ],
          "repo": "https://github.com/libwww-perl/HTTP-Body",
          "versions": [
            {
              "lessThan": "1.23_01",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies.\n\nIn chunked mode, used when no content length is given, add() matches each chunk-size line with `/^([\\da-fA-F]+).*\\x0D\\x0A/`. On a line of hex digits whose first LF has no CR before it, the digits and `.*` backtrack against each other, so a single add() takes time quadratic in the line\u0027s length. Nothing limits how long the line can be.\n\nA remote attacker can exhaust CPU in applications that pass chunked request bodies to HTTP::Body."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333 Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T17:16:16.997Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/libwww-perl/HTTP-Body/commit/954a5343d2a095b59d357f28759c5388d1169574.patch"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to HTTP-Body 1.23_01 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-116285",
    "datePublished": "2026-10-28T17:16:16.997Z",
    "dateReserved": "2026-10-25T23:54:54.524Z",
    "dateUpdated": "2026-11-05T21:01:35.355Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116268 (GCVE-0-2026-116268)

Vulnerability from cvelistv5 – Published: 2026-10-28 17:33 – Updated: 2026-11-05 20:30
VLAI
Title
MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters
Summary
MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters. The comment pattern used to parse Content-Type and Content-Disposition parameters scans from each "(" to the next ")". In a field with no ")", every "(" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity. A 40 KB header takes about 7 seconds to parse once.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 20:29 UTC
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
CPANSec CNA
References
Impacted products
Vendor Product Version
Affected: 0 , < 5.521 (custom)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-116268",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T20:29:37.240856Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T20:30:45.017Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "MIME::Field::ParamVal"
          ],
          "packageName": "MIME-tools",
          "packageURL": "pkg:cpan/MIME-tools",
          "programFiles": [
            "lib/MIME/Field/ParamVal.pm"
          ],
          "programRoutines": [
            {
              "name": "MIME::Field::ParamVal::parse_params"
            }
          ],
          "repo": "https://salsa.debian.org/dskoll/mime-tools",
          "versions": [
            {
              "lessThan": "5.521",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters.\n\nThe comment pattern used to parse Content-Type and Content-Disposition parameters scans from each \"(\" to the next \")\". In a field with no \")\", every \"(\" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity.\n\nA 40 KB header takes about 7 seconds to parse once."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333 Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T17:33:04.336Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to MIME-tools 5.521 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-116268",
    "datePublished": "2026-10-28T17:33:04.336Z",
    "dateReserved": "2026-10-25T18:05:02.236Z",
    "dateUpdated": "2026-11-05T20:30:45.017Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115887 (GCVE-0-2026-115887)

Vulnerability from cvelistv5 – Published: 2026-10-23 21:19 – Updated: 2026-10-30 18:45
VLAI
Title
graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service
Summary
GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits followed by a character that makes the match fail. GraphQL evaluates parseLiteral during document validation and parseValue during variable coercion before resolver authentication or authorization, so a small unauthenticated request can block the Node.js event loop and stall the server process. serialize is also affected when unvalidated stored values are returned through the scalar. This issue is fixed in version 2.0.1.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 18:44 UTC
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
GitHub_M CNA
References
Impacted products
Vendor Product Version
graphql-hive graphql-scalars Affected: >= 1.24.1, < 2.0.1
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115887",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T18:44:57.113367Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T18:45:04.885Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/graphql-hive/graphql-scalars/security/advisories/GHSA-x8rm-f576-gq67"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "graphql-scalars",
          "vendor": "graphql-hive",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.24.1, \u003c 2.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested digit quantifiers that backtrack exponentially when a PhoneNumber value contains a run of digits followed by a character that makes the match fail. GraphQL evaluates parseLiteral during document validation and parseValue during variable coercion before resolver authentication or authorization, so a small unauthenticated request can block the Node.js event loop and stall the server process. serialize is also affected when unvalidated stored values are returned through the scalar. This issue is fixed in version 2.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T21:19:42.561Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/graphql-hive/graphql-scalars/security/advisories/GHSA-x8rm-f576-gq67",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/graphql-hive/graphql-scalars/security/advisories/GHSA-x8rm-f576-gq67"
        },
        {
          "name": "https://github.com/graphql-hive/graphql-scalars/pull/2719",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-hive/graphql-scalars/pull/2719"
        },
        {
          "name": "https://github.com/graphql-hive/graphql-scalars/commit/210fd2485641afa2452800c00144245c74361701",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-hive/graphql-scalars/commit/210fd2485641afa2452800c00144245c74361701"
        },
        {
          "name": "https://github.com/graphql-hive/graphql-scalars/releases/tag/v2.0.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/graphql-hive/graphql-scalars/releases/tag/v2.0.1"
        }
      ],
      "source": {
        "advisory": "GHSA-x8rm-f576-gq67",
        "discovery": "UNKNOWN"
      },
      "title": "graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-115887",
    "datePublished": "2026-10-23T21:19:42.561Z",
    "dateReserved": "2026-10-23T19:37:27.176Z",
    "dateUpdated": "2026-10-30T18:45:04.885Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115866 (GCVE-0-2026-115866)

Vulnerability from cvelistv5 – Published: 2026-10-30 12:45 – Updated: 2026-11-06 16:44
VLAI
Title
Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies
Summary
Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a run of hex digits, then .* and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retries the match once for each digit, so the time taken grows with the square of the run length. Nothing limits the length of the run, which can span several reads. A remote attacker can occupy a worker for about a minute of CPU time with one 128 KiB request, before the application is called.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 16:43 UTC
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
CPANSec CNA
References
Impacted products
Vendor Product Version
Affected: 0.20 , < 0.33 (custom)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-115866",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T16:43:18.883792Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T16:44:02.533Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "Starlet"
          ],
          "packageName": "Starlet",
          "packageURL": "pkg:cpan/Starlet",
          "programFiles": [
            "lib/Starlet/Server.pm"
          ],
          "programRoutines": [
            {
              "name": "Starlet::Server::handle_connection"
            }
          ],
          "repo": "https://github.com/kazuho/Starlet",
          "versions": [
            {
              "lessThan": "0.33",
              "status": "affected",
              "version": "0.20",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies.\n\nA chunk-size line is matched as a run of hex digits, then .* and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retries the match once for each digit, so the time taken grows with the square of the run length. Nothing limits the length of the run, which can span several reads.\n\nA remote attacker can occupy a worker for about a minute of CPU time with one 128 KiB request, before the application is called."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333 Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:45:39.814Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/kazuho/Starlet/commit/229ea56b3b50028e2a644156317e8d0e7cf68a1f.patch"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/KAZUHO/Starlet-0.33/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to Starlet 0.33 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-115866",
    "datePublished": "2026-10-30T12:45:39.814Z",
    "dateReserved": "2026-10-23T17:41:34.521Z",
    "dateUpdated": "2026-11-06T16:44:02.533Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115822 (GCVE-0-2026-115822)

Vulnerability from cvelistv5 – Published: 2026-10-25 16:51 – Updated: 2026-11-02 14:19
VLAI
Title
Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies
Summary
Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked request bodies before calling the application, matching each chunk-size line with `s/^(([0-9a-fA-F]+).*\015\012)//`. A line of hex digits followed by a bare LF and then CRLF never matches, because `.` does not match LF, and each failed attempt backtracks in time quadratic in the length of the hex run. Nothing limits the length of the line. A remote attacker can exhaust worker CPU by sending such requests to any route.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 14:19 UTC
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
CPANSec CNA
References
Impacted products
Vendor Product Version
Affected: 0 , < 0.4019 (custom)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-115822",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T14:19:14.376911Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T14:19:20.636Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "Starman"
          ],
          "packageName": "Starman",
          "packageURL": "pkg:cpan/Starman",
          "programFiles": [
            "lib/Starman/Server.pm"
          ],
          "programRoutines": [
            {
              "name": "Starman::Server::_prepare_env"
            }
          ],
          "repo": "https://github.com/miyagawa/Starman",
          "versions": [
            {
              "lessThan": "0.4019",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies.\n\nStarman decodes chunked request bodies before calling the application, matching each chunk-size line with `s/^(([0-9a-fA-F]+).*\\015\\012)//`. A line of hex digits followed by a bare LF and then CRLF never matches, because `.` does not match LF, and each failed attempt backtracks in time quadratic in the length of the hex run. Nothing limits the length of the line.\n\nA remote attacker can exhaust worker CPU by sending such requests to any route."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333 Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-25T16:51:00.241Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/miyagawa/Starman/commit/0f33f9b132b5e410d6cce722ff71988e22476acf.patch"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/MIYAGAWA/Starman-0.4019/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to Starman 0.4019 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-115822",
    "datePublished": "2026-10-25T16:51:00.241Z",
    "dateReserved": "2026-10-23T16:47:20.192Z",
    "dateUpdated": "2026-11-02T14:19:20.636Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115728 (GCVE-0-2026-115728)

Vulnerability from cvelistv5 – Published: 2026-10-23 12:55 – Updated: 2026-10-26 19:58
VLAI
Title
@hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing
Summary
@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 19:42 UTC
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
hapijs @hapi/content Affected: 6.0.1 , < 6.0.3 (semver)
Create a notification for this product.
Date Public
2026-10-21 16:11
Credits
Zachariah Mithani (AploSec)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115728",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-26T19:42:22.330694Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-26T19:58:39.933Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/%40hapi/content",
          "product": "@hapi/content",
          "repo": "https://github.com/hapijs/content",
          "vendor": "hapijs",
          "versions": [
            {
              "lessThan": "6.0.3",
              "status": "affected",
              "version": "6.0.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zachariah Mithani (AploSec)"
        }
      ],
      "datePublic": "2026-10-21T16:11:05.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T12:55:08.425Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/hapijs/content/pull/42"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/hapijs/content/commit/0993851dc7234976a3fce3a7c31662b213c940fd"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/hapijs/content/tree/v6.0.3"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/hapijs/content/blob/v6.0.2/lib/index.js#L96"
        },
        {
          "name": "GitHub Security Advisory (GHSA-jg4p-7fhp-p32p)",
          "tags": [
            "related",
            "vendor-advisory"
          ],
          "url": "https://github.com/hapijs/content/security/advisories/GHSA-jg4p-7fhp-p32p"
        },
        {
          "name": "VulnCheck Advisory: @hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/hapi-content-6.0.1-before-6.0.3-redos-via-content-disposition-parameter-parsing"
        }
      ],
      "title": "@hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-115728",
    "datePublished": "2026-10-23T12:55:08.425Z",
    "dateReserved": "2026-10-23T11:40:38.070Z",
    "dateUpdated": "2026-10-26T19:58:39.933Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115508 (GCVE-0-2026-115508)

Vulnerability from cvelistv5 – Published: 2026-10-22 19:14 – Updated: 2026-10-29 02:36
VLAI
Title
Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fields
Summary
Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via RegexExtractionStrategy.custom, RegexChunking.patterns or JsonCss, JsonXPath and JsonLxml schema regex fields against a crafted page to freeze the entire server, including /health.
Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 02:35 UTC
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
unclecode crawl4ai Affected: 0.7.0 , < 0.9.5 (semver)
Unaffected: 0.9.5 (semver)
Create a notification for this product.
Date Public
2026-10-02 00:00
Credits
Zhixi Sun (manus-use) Siyang Wu
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115508",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T02:35:54.130520Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T02:36:22.691Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/unclecode/crawl4ai/security/advisories/GHSA-j843-8p47-rhxp"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/crawl4ai",
          "product": "crawl4ai",
          "vendor": "unclecode",
          "versions": [
            {
              "lessThan": "0.9.5",
              "status": "affected",
              "version": "0.7.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.9.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zhixi Sun (manus-use)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Siyang Wu"
        }
      ],
      "datePublic": "2026-10-02T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API server that allows authenticated API clients to supply unbounded regular expressions in /crawl request bodies. Attackers can submit catastrophic-backtracking patterns via RegexExtractionStrategy.custom, RegexChunking.patterns or JsonCss, JsonXPath and JsonLxml schema regex fields against a crafted page to freeze the entire server, including /health."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T19:14:07.893Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-j843-8p47-rhxp)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/unclecode/crawl4ai/security/advisories/GHSA-j843-8p47-rhxp"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/unclecode/crawl4ai/commit/8aea2006e2cdb96a185e50b20633fc323dff6429"
        },
        {
          "name": "crawl4ai v0.9.5 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/unclecode/crawl4ai/releases/tag/v0.9.5"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/unclecode/crawl4ai"
        },
        {
          "name": "VulnCheck Advisory: Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fields",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/crawl4ai-0.7.0-before-0.9.5-redos-via-crawl-regex-fields"
        }
      ],
      "title": "Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fields",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-115508",
    "datePublished": "2026-10-22T19:14:07.893Z",
    "dateReserved": "2026-10-22T16:15:00.201Z",
    "dateUpdated": "2026-10-29T02:36:22.691Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115349 (GCVE-0-2026-115349)

Vulnerability from cvelistv5 – Published: 2026-10-22 19:13 – Updated: 2026-10-26 19:38
VLAI
Title
Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing
Summary
Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 19:27 UTC
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
lepture mistune Affected: 3.0.0 , < 3.3.0 (semver)
Unaffected: 3.3.0 (semver)
    cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-06-21 00:00
Credits
dapickle
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115349",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-26T19:27:03.150656Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-26T19:38:30.354Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/mistune",
          "product": "mistune",
          "vendor": "lepture",
          "versions": [
            {
              "lessThan": "3.3.0",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:mistune_project:mistune:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.3.0",
                  "versionStartIncluding": "3.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "dapickle"
        }
      ],
      "datePublic": "2026-06-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T19:13:26.171Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-3q64-rw38-243v)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/lepture/mistune/security/advisories/GHSA-3q64-rw38-243v"
        },
        {
          "name": "VulnCheck Advisory: Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/mistune-3.0.0-before-3.3.0-denial-of-service-via-nested-bracket-parsing"
        }
      ],
      "title": "Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-115349",
    "datePublished": "2026-10-22T19:13:26.171Z",
    "dateReserved": "2026-10-22T11:20:02.626Z",
    "dateUpdated": "2026-10-26T19:38:30.354Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation
Architecture and Design

Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.

Mitigation
System Configuration

Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.

Mitigation
Implementation

Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.

Mitigation
Implementation

Limit the length of the input that the regular expression will process.

CAPEC-492: Regular Expression Exponential Blowup

An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.

← Back to the CWE list