Common Weakness Enumeration
CWE-1333
AllowedInefficient Regular Expression Complexity
Abstraction: Base · Status: Draft
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
904 vulnerabilities reference this CWE, most recent first.
CVE-2026-111997 (GCVE-0-2026-111997)
Vulnerability from cvelistv5 – Published: 2026-10-18 00:07 – Updated: 2026-10-18 11:12
VLAI
EPSS
VEX
Summary
ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 11:12 UTC
CWE
- CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| beaugunderson | ip-address |
Affected:
0 , < 10.7.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111997",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T11:12:34.844670Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:12:55.202Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/ip-address",
"product": "ip-address",
"vendor": "beaugunderson",
"versions": [
{
"lessThan": "10.7.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333 Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T00:07:21.112Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-111997",
"datePublished": "2026-10-18T00:07:21.112Z",
"dateReserved": "2026-10-18T00:07:20.697Z",
"dateUpdated": "2026-10-18T11:12:55.202Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111714 (GCVE-0-2026-111714)
Vulnerability from cvelistv5 – Published: 2026-10-16 17:40 – Updated: 2026-10-16 17:40
VLAI
EPSS
VEX
Title
tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge
Summary
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.
Severity
CWE
- CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/AmauriC/tarteaucitron.js/commi… | patch |
| https://github.com/AmauriC/tarteaucitron.js/relea… | release-notes |
| https://github.com/AmauriC/tarteaucitron.js/blob/… | technical-description |
| https://www.vulncheck.com/advisories/tarteaucitro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AmauriC | tarteaucitron.js |
Affected:
0 , < 1.37.0
(semver)
cpe:2.3:a:amauri:tarteaucitronjs:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/AmauriC/tarteaucitron.js",
"product": "tarteaucitron.js",
"repo": "https://github.com/AmauriC/tarteaucitron.js",
"vendor": "AmauriC",
"versions": [
{
"lessThan": "1.37.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:amauri:tarteaucitronjs:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.37.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zachariah Mithani"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:40:03.460Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/AmauriC/tarteaucitron.js/commit/60faaba5fd541cad770549d422fc4ac7de657e56"
},
{
"name": "tarteaucitron.js v1.37.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/AmauriC/tarteaucitron.js/releases/tag/v1.37.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/AmauriC/tarteaucitron.js/blob/v1.36.0/tarteaucitron.js#L2169-L2175"
},
{
"name": "VulnCheck Advisory: tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/tarteaucitron-js-before-1.37.0-redos-via-unescaped-cookie-name-in-cookie-purge"
}
],
"title": "tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111714",
"datePublished": "2026-10-16T17:40:03.460Z",
"dateReserved": "2026-10-16T14:31:23.634Z",
"dateUpdated": "2026-10-16T17:40:03.460Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110869 (GCVE-0-2026-110869)
Vulnerability from cvelistv5 – Published: 2026-10-14 22:52 – Updated: 2026-10-15 15:35
VLAI
EPSS
VEX
Title
Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes
Summary
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 15:35 UTC
CWE
- CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/nodemailer/nodemailer/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/nodemailer-3… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| nodemailer | nodemailer |
Affected:
3.0.0 , < 10.0.13
(semver)
Unaffected: 10.0.13 (semver) cpe:2.3:a:nodemailer:nodemailer:*:*:*:*:*:*:*:* |
Date Public
2026-09-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110869",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T15:35:06.757255Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:35:29.075Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4ffr-jq9g-5ffx"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/nodemailer",
"product": "nodemailer",
"vendor": "nodemailer",
"versions": [
{
"lessThan": "10.0.13",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "10.0.13",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nodemailer:nodemailer:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.13",
"versionStartIncluding": "3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "manus-pi"
},
{
"lang": "en",
"type": "reporter",
"value": "manus-use"
}
],
"datePublic": "2026-09-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with 250-AUTH, a long whitespace run and a non-matching token, blocking the Node.js event loop for tens of seconds to hours before authentication."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T22:52:57.866Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-4ffr-jq9g-5ffx)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4ffr-jq9g-5ffx"
},
{
"name": "VulnCheck Advisory: Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.13-redos-via-smtp-auth-mechanism-detection-regexes"
}
],
"title": "Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110869",
"datePublished": "2026-10-14T22:52:57.866Z",
"dateReserved": "2026-10-14T22:21:21.396Z",
"dateUpdated": "2026-10-15T15:35:29.075Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110856 (GCVE-0-2026-110856)
Vulnerability from cvelistv5 – Published: 2026-10-14 22:52 – Updated: 2026-10-14 22:52
VLAI
EPSS
VEX
Title
GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date
Summary
GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch or timezone, causing quadratic backtracking and CPU exhaustion.
Severity
CWE
- CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/gitpython-developers/GitPython… | vendor-advisory |
| https://www.vulncheck.com/advisories/gitpython-be… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| gitpython-developers | GitPython |
Affected:
0 , < 3.2.0
(semver)
Unaffected: 3.2.0 (semver) cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:*:*:* |
Date Public
2026-09-30 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/GitPython",
"product": "GitPython",
"vendor": "gitpython-developers",
"versions": [
{
"lessThan": "3.2.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.2.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "BrianWillows"
}
],
"datePublic": "2026-09-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing long space-filled lines lacking a valid epoch or timezone, causing quadratic backtracking and CPU exhaustion."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T22:52:38.541Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-m64x-33q8-m5h7)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-m64x-33q8-m5h7"
},
{
"name": "VulnCheck Advisory: GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/gitpython-before-3.2.0-redos-via-re-actor-epoch-in-parse-actor-and-date"
}
],
"title": "GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110856",
"datePublished": "2026-10-14T22:52:38.541Z",
"dateReserved": "2026-10-14T22:16:22.734Z",
"dateUpdated": "2026-10-14T22:52:38.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110594 (GCVE-0-2026-110594)
Vulnerability from cvelistv5 – Published: 2026-10-14 14:16 – Updated: 2026-10-16 11:39
VLAI
EPSS
VEX
Title
BottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex
Summary
BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern evaluated by _match_condition() during case saves, exhausting workers shared across all tenants.
Severity
4.9 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 16:13 UTC
CWE
- CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Django-CRM/Django-CRM/issues/830 | issue-tracking |
| https://github.com/Django-CRM/Django-CRM/blob/v1.… | technical-description |
| https://github.com/aaronamran/CVE-Disclosures/tre… | technical-descriptionexploit |
| https://www.vulncheck.com/advisories/bottlecrm-0.… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MicroPyramid | BottleCRM |
Affected:
0.43 , ≤ 1.14.5
(custom)
cpe:2.3:a:micropyramid:django_crm:*:*:*:*:*:*:*:* |
Date Public
2026-10-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110594",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T16:13:21.486834Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T16:13:50.755Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Django-CRM/Django-CRM/issues/830"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pypi.org",
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/django-crm",
"product": "BottleCRM",
"repo": "https://github.com/Django-CRM/Django-CRM",
"vendor": "MicroPyramid",
"versions": [
{
"lessThanOrEqual": "1.14.5",
"status": "affected",
"version": "0.43",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:micropyramid:django_crm:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.14.5",
"versionStartIncluding": "0.43",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Aaron Amran Bin Amiruddin (@aaronamran)"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. Attackers can create a routing rule with a catastrophically backtracking pattern evaluated by _match_condition() during case saves, exhausting workers shared across all tenants."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T11:39:00.692Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Django-CRM/Django-CRM/issues/830"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Django-CRM/Django-CRM/blob/v1.14.5/backend/cases/routing.py#L107-L114"
},
{
"name": "Researcher Disclosure",
"tags": [
"technical-description",
"exploit"
],
"url": "https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-110594"
},
{
"name": "VulnCheck Advisory: BottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/bottlecrm-0.43-through-1.14.5-redos-via-case-routing-rule-regex"
}
],
"title": "BottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110594",
"datePublished": "2026-10-14T14:16:38.449Z",
"dateReserved": "2026-10-14T13:07:18.254Z",
"dateUpdated": "2026-10-16T11:39:00.692Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109563 (GCVE-0-2026-109563)
Vulnerability from cvelistv5 – Published: 2026-10-12 20:55 – Updated: 2026-10-14 11:33
VLAI
EPSS
VEX
Title
N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex
Summary
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 11:31 UTC
CWE
- CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/rdfjs/N3.js/pull/760 | issue-trackingpatch |
| https://github.com/rdfjs/N3.js/commit/b1c497fddb0… | patch |
| https://github.com/rdfjs/N3.js | product |
| https://www.vulncheck.com/advisories/n3-js-before… | third-party-advisory |
Impacted products
Date Public
2026-10-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109563",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T11:31:53.727267Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T11:33:26.609Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n3",
"product": "N3.js",
"repo": "https://github.com/rdfjs/N3.js",
"vendor": "rdfjs",
"versions": [
{
"lessThan": "2.11.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.11.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mohammed Arfath A"
}
],
"datePublic": "2026-10-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T20:55:16.880Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Pull Request #760",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/rdfjs/N3.js/pull/760"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/rdfjs/N3.js/commit/b1c497fddb02c4772d61916bd2634115f45f424d"
},
{
"tags": [
"product"
],
"url": "https://github.com/rdfjs/N3.js"
},
{
"name": "VulnCheck Advisory: N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/n3-js-before-2.11.1-redos-via-n3lexer-numeric-literal-regex"
}
],
"title": "N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109563",
"datePublished": "2026-10-12T20:55:16.880Z",
"dateReserved": "2026-10-12T19:27:52.560Z",
"dateUpdated": "2026-10-14T11:33:26.609Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109295 (GCVE-0-2026-109295)
Vulnerability from cvelistv5 – Published: 2026-10-12 16:04 – Updated: 2026-10-13 18:09
VLAI
EPSS
VEX
Title
Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop
Summary
Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns. Attackers can instruct the model to call grep_knowledge_files or grep_chat_files with a catastrophically backtracking regex, blocking the event loop for two seconds per repeated call.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 18:08 UTC
CWE
- CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.11.0 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109295",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T18:08:41.758895Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:09:05.825Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-gfjp-5hc9-852r"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.11.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.11.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "yousif-IQ"
},
{
"lang": "en",
"type": "finder",
"value": "Classic298"
}
],
"datePublic": "2026-09-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns. Attackers can instruct the model to call grep_knowledge_files or grep_chat_files with a catastrophically backtracking regex, blocking the event loop for two seconds per repeated call."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:54.739Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-gfjp-5hc9-852r)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-gfjp-5hc9-852r"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.11.0-before-0.11.4-redos-via-grep-knowledge-files-event-loop"
}
],
"title": "Open WebUI 0.11.0 before 0.11.4 ReDoS via grep_knowledge_files Event Loop",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109295",
"datePublished": "2026-10-12T16:04:54.739Z",
"dateReserved": "2026-10-12T14:12:52.833Z",
"dateUpdated": "2026-10-13T18:09:05.825Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108082 (GCVE-0-2026-108082)
Vulnerability from cvelistv5 – Published: 2026-10-15 14:46 – Updated: 2026-10-15 18:04
VLAI
EPSS
VEX
Title
Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
Summary
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication.
A single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped.
This issue affects symfony/http-foundation v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through v6.4.45, v7.0.0-BETA1 through v7.4.18, and v8.0.0-BETA1 through v8.1.6.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 18:04 UTC
CWE
- CWE-1333 - Inefficient regular expression complexity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/symfony/symfony/pull/66048 | patch |
| https://github.com/symfony/symfony/pull/66491 | patch |
| https://github.com/symfony/symfony/security/advis… | vendor-advisory |
| https://symfony.com/blog/cve-2026-108082-redos-in… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sensiolabs | symfony |
Affected:
v4.1.0-BETA1 , < v5.4.54
(git)
Affected: v6.0.0-BETA1 , < v6.4.46 (git) Affected: v7.0.0-BETA1 , < v7.4.19 (git) Affected: v8.0.0-BETA1 , < v8.1.7 (git) cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* |
Date Public
2026-09-14 11:59
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108082",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T18:04:09.776300Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:04:45.913Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/packages/symfony/http-foundation",
"defaultStatus": "unaffected",
"modules": [
"Symfony\\Component\\HttpFoundation\\HeaderUtils::split()"
],
"packageName": "symfony/http-foundation",
"product": "symfony",
"repo": "https://github.com/symfony/http-foundation",
"vendor": "sensiolabs",
"versions": [
{
"lessThan": "v5.4.54",
"status": "affected",
"version": "v4.1.0-BETA1",
"versionType": "git"
},
{
"lessThan": "v6.4.46",
"status": "affected",
"version": "v6.0.0-BETA1",
"versionType": "git"
},
{
"lessThan": "v7.4.19",
"status": "affected",
"version": "v7.0.0-BETA1",
"versionType": "git"
},
{
"lessThan": "v8.1.7",
"status": "affected",
"version": "v8.0.0-BETA1",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v5.4.54",
"versionStartIncluding": "v4.1.0-beta1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v6.4.46",
"versionStartIncluding": "v6.0.0-beta1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v7.4.19",
"versionStartIncluding": "v7.0.0-beta1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "v8.1.7",
"versionStartIncluding": "v8.0.0-beta1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "r3verii"
},
{
"lang": "en",
"type": "other",
"value": "Duarte Santos"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nicolas Grekas"
}
],
"datePublic": "2026-09-14T11:59:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSymfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions\u0026nbsp;\u003cspan\u003e5.4.54,\u0026nbsp;\u003c/span\u003e\u003cspan\u003e6.4.46,\u0026nbsp;\u003c/span\u003e\u003cspan\u003e7.4.19, and\u0026nbsp;\u003c/span\u003e\u003cspan\u003e8.1.7,\u0026nbsp;\u003c/span\u003e\u003ccode\u003eHeaderUtils::split()\u003c/code\u003e\u003cspan\u003e parsed header values with a pattern whose token alternative also matched whitespace, followed by a \u003c/span\u003e\u003ccode\u003e(?\u0026lt;!\\s)\u003c/code\u003e\u003cspan\u003e lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. \u003c/span\u003e\u003ccode\u003eHeaderBag\u003c/code\u003e\u003cspan\u003e calls it for the \u003c/span\u003e\u003ccode\u003eCache-Control\u003c/code\u003e\u003cspan\u003e header whenever a \u003c/span\u003e\u003ccode\u003eRequest\u003c/code\u003e\u003cspan\u003e is built, so any application handling HTTP requests is reachable, with no authentication.\u003c/span\u003e\u003c/p\u003e\u003cp\u003eA single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, \u003ccode\u003epreg_match_all()\u003c/code\u003e gives up at \u003ccode\u003epcre.backtrack_limit\u003c/code\u003e and \u003ccode\u003esplit()\u003c/code\u003e returns an empty array, so every directive of the header is silently dropped.\u003c/p\u003e\u003cp\u003eThis issue affects \u003ccode\u003esymfony/http-foundation\u003c/code\u003e\u0026nbsp;v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through\u0026nbsp;v6.4.45, v7.0.0-BETA1 through\u0026nbsp;v7.4.18, and v8.0.0-BETA1 through\u0026nbsp;v8.1.6.\u003c/p\u003e"
}
],
"value": "Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions\u00a05.4.54,\u00a06.4.46,\u00a07.4.19, and\u00a08.1.7,\u00a0HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?\u003c!\\s) lookbehind. A run of whitespace placed before a separator could be divided among the iterations of the enclosing repetition in exponentially many ways, and the engine tried all of them before settling. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable, with no authentication.\n\n\n\nA single request carrying such a header costs close to a second of CPU (813 ms for a run of 17 spaces in an 8 KB header on PHP 8.5, doubling with each extra space). From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, so every directive of the header is silently dropped.\n\n\n\nThis issue affects symfony/http-foundation\u00a0v4.1.0-BETA1 through v5.4.53, v6.0.0-BETA1 through\u00a0v6.4.45, v7.0.0-BETA1 through\u00a0v7.4.18, and v8.0.0-BETA1 through\u00a0v8.1.6."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333 Inefficient regular expression complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:32:05.788Z",
"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"shortName": "Checkmarx"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/pull/66048"
},
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/pull/66491"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/symfony/symfony/security/advisories/GHSA-r925-mgvr-h9cc"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://symfony.com/blog/cve-2026-108082-redos-in-headerutils-split-reachable-through-the-cache-control-request-header"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"assignerShortName": "Checkmarx",
"cveId": "CVE-2026-108082",
"datePublished": "2026-10-15T14:46:01.594Z",
"dateReserved": "2026-10-09T12:09:17.141Z",
"dateUpdated": "2026-10-15T18:04:45.913Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107572 (GCVE-0-2026-107572)
Vulnerability from cvelistv5 – Published: 2026-10-08 11:46 – Updated: 2026-10-08 17:35
VLAI
EPSS
VEX
Title
Inefficient Regular Expression Complexity in hMailServer
Summary
Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mail services unavailable with their own filter. A ':matches' pattern was matched by a backtracking descent whose time grew with the matched value's length raised to the number of wildcards, so a pattern such as '*a*a*a*b' over 800 characters took 44 seconds; and 'deleteheader' erased the fields it removed one at a time, so removing many fields of one name over a message's header cost O(N^2) (80,000 fields took 18.8 seconds). Sieve filters run on the small, shared delivery thread pool, so an account holder whose active script does this, fed a few messages they can send themselves, empties the pool and stops delivery for the whole server. The script is the account holder's own and cannot be set for another user.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 17:35 UTC
CWE
- CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progressive Robot Ltd | hMailServer |
Affected:
6.2.24 , < 6.3.6
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107572",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T17:35:04.470485Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T17:35:21.719Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "hMailServer",
"repo": "https://gitlab.com/hmailserver/hmailserver",
"vendor": "Progressive Robot Ltd",
"versions": [
{
"lessThan": "6.3.6",
"status": "affected",
"version": "6.2.24",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Found in the hMailServer project\u0027s own security review (Progressive Robot Ltd)"
}
],
"descriptions": [
{
"lang": "en",
"value": "Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mail services unavailable with their own filter. A \u0027:matches\u0027 pattern was matched by a backtracking descent whose time grew with the matched value\u0027s length raised to the number of wildcards, so a pattern such as \u0027*a*a*a*b\u0027 over 800 characters took 44 seconds; and \u0027deleteheader\u0027 erased the fields it removed one at a time, so removing many fields of one name over a message\u0027s header cost O(N^2) (80,000 fields took 18.8 seconds). Sieve filters run on the small, shared delivery thread pool, so an account holder whose active script does this, fed a few messages they can send themselves, empties the pool and stops delivery for the whole server. The script is the account holder\u0027s own and cannot be set for another user."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333: Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T11:46:41.080Z",
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab"
},
"references": [
{
"url": "https://gitlab.com/hmailserver/hmailserver/-/work_items/75"
},
{
"url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to hMailServer 6.3.6, which matches a \u0027:matches\u0027 pattern by placing each piece once (time linear in the value times the pattern) and removes \u0027deleteheader\u0027 fields in one pass. Until then, review active Sieve scripts for \u0027:matches\u0027 patterns with several wildcards and for \u0027deleteheader\u0027, and lower the maximum message size."
}
],
"title": "Inefficient Regular Expression Complexity in hMailServer"
}
},
"cveMetadata": {
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"cveId": "CVE-2026-107572",
"datePublished": "2026-10-08T11:46:41.080Z",
"dateReserved": "2026-10-08T10:51:25.637Z",
"dateUpdated": "2026-10-08T17:35:21.719Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107290 (GCVE-0-2026-107290)
Vulnerability from cvelistv5 – Published: 2026-10-08 16:09 – Updated: 2026-10-09 15:15
VLAI
EPSS
VEX
Title
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`
Summary
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback process server-controlled responses with quadratic title extraction, whitespace normalization, and ordered-list numbering. An attacker-controlled page of modest size can therefore block the event loop for an extended period, stalling other agent runs and requests, while unsupported codecs or excessive HTML or JSON nesting can abort an individual run. This issue is fixed in versions 1.107.6 and 2.44.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 20:23 UTC
CWE
- CWE-1333 - Inefficient Regular Expression Complexity
Assigner
References
13 references
| URL | Tags |
|---|---|
| https://github.com/pydantic/pydantic-ai/security/… | x_refsource_CONFIRM |
| https://github.com/pydantic/pydantic-ai/pull/8397 | x_refsource_MISC |
| https://github.com/pydantic/pydantic-ai/pull/8399 | x_refsource_MISC |
| https://github.com/pydantic/pydantic-ai/pull/8418 | x_refsource_MISC |
| https://github.com/pydantic/pydantic-ai/pull/84332 | x_refsource_MISC |
| https://github.com/pydantic/pydantic-ai/pull/8434 | x_refsource_MISC |
| https://github.com/pydantic/pydantic-ai/commit/2f… | x_refsource_MISC |
| https://github.com/pydantic/pydantic-ai/commit/9c… | x_refsource_MISC |
| https://github.com/pydantic/pydantic-ai/commit/a9… | x_refsource_MISC |
| https://github.com/pydantic/pydantic-ai/commit/c3… | x_refsource_MISC |
| https://github.com/pydantic/pydantic-ai/commit/fb… | x_refsource_MISC |
| https://github.com/pydantic/pydantic-ai/releases/… | x_refsource_MISC |
| https://github.com/pydantic/pydantic-ai/releases/… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| pydantic | pydantic-ai |
Affected:
>= 1.77.0, < 1.107.6
Affected: >= 2.0.0b1, < 2.44.0 |
|
| pydantic | pydantic-ai-slim |
Affected:
>= 1.77.0, < 1.107.6
Affected: >= 2.0.0b1, < 2.44.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107290",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T20:23:20.403829Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T15:15:26.958Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pydantic-ai",
"vendor": "pydantic",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.77.0, \u003c 1.107.6"
},
{
"status": "affected",
"version": "\u003e= 2.0.0b1, \u003c 2.44.0"
}
]
},
{
"product": "pydantic-ai-slim",
"vendor": "pydantic",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.77.0, \u003c 1.107.6"
},
{
"status": "affected",
"version": "\u003e= 2.0.0b1, \u003c 2.44.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback process server-controlled responses with quadratic title extraction, whitespace normalization, and ordered-list numbering. An attacker-controlled page of modest size can therefore block the event loop for an extended period, stalling other agent runs and requests, while unsupported codecs or excessive HTML or JSON nesting can abort an individual run. This issue is fixed in versions 1.107.6 and 2.44.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1333",
"description": "CWE-1333: Inefficient Regular Expression Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T16:09:04.272Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-fpf4-vwcp-v4hp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-fpf4-vwcp-v4hp"
},
{
"name": "https://github.com/pydantic/pydantic-ai/pull/8397",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/pull/8397"
},
{
"name": "https://github.com/pydantic/pydantic-ai/pull/8399",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/pull/8399"
},
{
"name": "https://github.com/pydantic/pydantic-ai/pull/8418",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/pull/8418"
},
{
"name": "https://github.com/pydantic/pydantic-ai/pull/84332",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/pull/84332"
},
{
"name": "https://github.com/pydantic/pydantic-ai/pull/8434",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/pull/8434"
},
{
"name": "https://github.com/pydantic/pydantic-ai/commit/2faa6181d8a17d83bc9516d035c5270db8730fa0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/commit/2faa6181d8a17d83bc9516d035c5270db8730fa0"
},
{
"name": "https://github.com/pydantic/pydantic-ai/commit/9cdc952e4c3319e85a3e04f2de49fbbb765bd38b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/commit/9cdc952e4c3319e85a3e04f2de49fbbb765bd38b"
},
{
"name": "https://github.com/pydantic/pydantic-ai/commit/a93ea5226be1e93ae13131ae3f22287190411389",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/commit/a93ea5226be1e93ae13131ae3f22287190411389"
},
{
"name": "https://github.com/pydantic/pydantic-ai/commit/c3fd1cc1f15fdbf750d78e4e3ec1e8b4d6a3d920",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/commit/c3fd1cc1f15fdbf750d78e4e3ec1e8b4d6a3d920"
},
{
"name": "https://github.com/pydantic/pydantic-ai/commit/fb92ccfc3ca2735dab877e2ed73856681bf72ad1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/commit/fb92ccfc3ca2735dab877e2ed73856681bf72ad1"
},
{
"name": "https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6"
},
{
"name": "https://github.com/pydantic/pydantic-ai/releases/tag/v2.44.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/releases/tag/v2.44.0"
}
],
"source": {
"advisory": "GHSA-fpf4-vwcp-v4hp",
"discovery": "UNKNOWN"
},
"title": "Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107290",
"datePublished": "2026-10-08T16:09:04.272Z",
"dateReserved": "2026-10-07T15:53:23.586Z",
"dateUpdated": "2026-10-09T15:15:26.958Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
Mitigation
System Configuration
Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
Mitigation
Implementation
Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
Mitigation
Implementation
Limit the length of the input that the regular expression will process.
CAPEC-492: Regular Expression Exponential Blowup
An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.