Common Weakness Enumeration

CWE-1333

Allowed

Inefficient Regular Expression Complexity

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

905 vulnerabilities reference this CWE, most recent first.

CVE-2026-83606 (GCVE-0-2026-83606)

Vulnerability from cvelistv5 – Published: 2026-09-01 14:21 – Updated: 2026-09-01 14:57
VLAI
Title
xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions
Summary
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.9 until 0.9.11, the processing-instruction production in lib/grammar.js lets the greedy S+ separator and lazy Char*? data group repeatedly repartition a long whitespace tail when the required closing ?> is absent. Both parsePI and parseProcessingInstruction apply the expression to the entire remaining source, causing quadratic backtracking during DOMParser.parseFromString() under default options and allowing a small unauthenticated XML input to stall the Node.js event loop. This issue is fixed in @xmldom/xmldom version 0.9.11.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 14:57 UTC
CWE
  • CWE-400 - Uncontrolled Resource Consumption
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7620 records in the last 180 days details
References
Impacted products
Vendor Product Version
xmldom xmldom Affected: >= 0.9.0-beta.9, < 0.9.11
Create a notification for this product.
@xmldom xmldom Affected: >= 0.9.0-beta.9, < 0.9.11
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-83606",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-01T14:57:15.918491Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T14:57:43.875Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-g53g-w8rj-fmg7"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "xmldom",
          "vendor": "xmldom",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.9.0-beta.9, \u003c 0.9.11"
            }
          ]
        },
        {
          "product": "xmldom",
          "vendor": "@xmldom",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.9.0-beta.9, \u003c 0.9.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.9 until 0.9.11, the processing-instruction production in lib/grammar.js lets the greedy S+ separator and lazy Char*? data group repeatedly repartition a long whitespace tail when the required closing ?\u003e is absent. Both parsePI and parseProcessingInstruction apply the expression to the entire remaining source, causing quadratic backtracking during DOMParser.parseFromString() under default options and allowing a small unauthenticated XML input to stall the Node.js event loop. This issue is fixed in @xmldom/xmldom version 0.9.11."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T14:21:27.215Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/xmldom/xmldom/security/advisories/GHSA-g53g-w8rj-fmg7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-g53g-w8rj-fmg7"
        },
        {
          "name": "https://github.com/xmldom/xmldom/pull/1039",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/xmldom/xmldom/pull/1039"
        },
        {
          "name": "https://github.com/xmldom/xmldom/commit/73df6b8bdbd86f904b9e8c3ab9c49aa54ef2802e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/xmldom/xmldom/commit/73df6b8bdbd86f904b9e8c3ab9c49aa54ef2802e"
        },
        {
          "name": "https://github.com/xmldom/xmldom/releases/tag/0.9.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/xmldom/xmldom/releases/tag/0.9.11"
        }
      ],
      "source": {
        "advisory": "GHSA-g53g-w8rj-fmg7",
        "discovery": "UNKNOWN"
      },
      "title": "xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-83606",
    "datePublished": "2026-09-01T14:21:27.215Z",
    "dateReserved": "2026-08-31T20:36:25.743Z",
    "dateUpdated": "2026-09-01T14:57:43.875Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-80206 (GCVE-0-2026-80206)

Vulnerability from cvelistv5 – Published: 2026-08-26 10:28 – Updated: 2026-08-26 12:52
VLAI
Title
NLTK 3.10.2 Regular Expression Denial of Service via tgrep
Summary
NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or timeout. An attacker who controls the tgrep pattern (e.g., via tgrep_positions() or tgrep_compile() exposed to external input) can supply a pattern that triggers catastrophic backtracking, causing indefinite CPU saturation that blocks the Python process.
Severity
8.2 (High)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 12:52 UTC
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6476 records in the last 180 days details
References
Impacted products
Vendor Product Version
nltk nltk Affected: 0 , < 3.10.3 (semver)
Unaffected: 3.10.3 (semver)
    cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-08-12 00:00
Credits
infycore ekaf agent-kira
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80206",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T12:52:03.078501Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T12:52:23.513Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nltk/nltk/security/advisories/GHSA-w3v8-gmh9-3wv7"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/nltk",
          "product": "nltk",
          "vendor": "nltk",
          "versions": [
            {
              "lessThan": "3.10.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.10.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.10.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "infycore"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "ekaf"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "agent-kira"
        }
      ],
      "datePublic": "2026-08-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or timeout. An attacker who controls the tgrep pattern (e.g., via tgrep_positions() or tgrep_compile() exposed to external input) can supply a pattern that triggers catastrophic backtracking, causing indefinite CPU saturation that blocks the Python process."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T10:28:15.035Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-w3v8-gmh9-3wv7)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/nltk/nltk/security/advisories/GHSA-w3v8-gmh9-3wv7"
        },
        {
          "name": "VulnCheck Advisory: NLTK 3.10.2 Regular Expression Denial of Service via tgrep",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nltk-3.10.2-regular-expression-denial-of-service-via-tgrep"
        }
      ],
      "title": "NLTK 3.10.2 Regular Expression Denial of Service via tgrep",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-80206",
    "datePublished": "2026-08-26T10:28:15.035Z",
    "dateReserved": "2026-08-25T23:15:39.155Z",
    "dateUpdated": "2026-08-26T12:52:23.513Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-80205 (GCVE-0-2026-80205)

Vulnerability from cvelistv5 – Published: 2026-08-26 10:28 – Updated: 2026-09-01 22:06
VLAI
Title
NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regex
Summary
NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 15:58 UTC
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6476 records in the last 180 days details
References
Impacted products
Vendor Product Version
nltk nltk Affected: 0 , < 3.10.0 (semver)
Unaffected: 3.10.0 (semver)
    cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-08-12 00:00
Credits
infycore ekaf agent-kira
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80205",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T15:58:57.043941Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T16:09:59.270Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-01T22:06:44.235Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/01/3"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/nltk",
          "product": "nltk",
          "vendor": "nltk",
          "versions": [
            {
              "lessThan": "3.10.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.10.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.10.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "infycore"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "ekaf"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "agent-kira"
        }
      ],
      "datePublic": "2026-08-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T10:28:14.352Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-rrv8-h7p8-rx55)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/nltk/nltk/security/advisories/GHSA-rrv8-h7p8-rx55"
        },
        {
          "name": "VulnCheck Advisory: NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regex",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nltk-before-3.10.0-redos-via-text-findall-unvalidated-regex"
        }
      ],
      "title": "NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regex",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-80205",
    "datePublished": "2026-08-26T10:28:14.352Z",
    "dateReserved": "2026-08-25T23:15:39.155Z",
    "dateUpdated": "2026-09-01T22:06:44.235Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79770 (GCVE-0-2026-79770)

Vulnerability from cvelistv5 – Published: 2026-08-25 15:16 – Updated: 2026-09-16 15:51
VLAI
Title
Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer
Summary
Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 16:10 UTC
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6476 records in the last 180 days details
References
Impacted products
Vendor Product Version
sparklemotion nokogiri Affected: 0 , < 1.19.3 (semver)
Unaffected: 1.19.3 (semver)
    cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-04-27 00:00
Credits
colby-swandale flavorjones
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79770",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-25T16:10:25.348193Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T15:51:27.061Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:gem/nokogiri",
          "product": "nokogiri",
          "vendor": "sparklemotion",
          "versions": [
            {
              "lessThan": "1.19.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.19.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nokogiri:nokogiri:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.19.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "colby-swandale"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "flavorjones"
        }
      ],
      "datePublic": "2026-04-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T15:16:03.059Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-c4rq-3m3g-8wgx)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-c4rq-3m3g-8wgx"
        },
        {
          "name": "VulnCheck Advisory: Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nokogiri-before-redos-via-css-selector-tokenizer"
        }
      ],
      "title": "Nokogiri before 1.19.3 ReDoS via CSS selector tokenizer",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-79770",
    "datePublished": "2026-08-25T15:16:03.059Z",
    "dateReserved": "2026-08-25T14:29:43.528Z",
    "dateUpdated": "2026-09-16T15:51:27.061Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77423 (GCVE-0-2026-77423)

Vulnerability from cvelistv5 – Published: 2026-09-23 18:17 – Updated: 2026-09-24 14:10
VLAI
Title
JLine: ReDoS in Built-in Less Viewer Search
Summary
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPattern(boolean doDisplayPattern) in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's backtracking regular expression engine and repeatedly applies them to file content. A nested-quantifier expression evaluated against non-matching lines can consume excessive CPU and indefinitely block the session thread, and repeated sessions in Telnet or SSH deployments can exhaust a bounded worker pool. This issue is fixed in versions 3.30.15 and 4.3.1.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 14:10 UTC
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7620 records in the last 180 days details
References
Impacted products
Vendor Product Version
jline jline3 Affected: >= 3.0.0, < 3.30.15
Affected: >= 4.0.0, < 4.3.1
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77423",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T14:10:41.490849Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T14:10:52.736Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/jline/jline3/security/advisories/GHSA-2v9w-34q6-wpqx"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jline3",
          "vendor": "jline",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.30.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPattern(boolean doDisplayPattern) in builtins/src/main/java/org/jline/builtins/Less.java directly to Java\u0027s backtracking regular expression engine and repeatedly applies them to file content. A nested-quantifier expression evaluated against non-matching lines can consume excessive CPU and indefinitely block the session thread, and repeated sessions in Telnet or SSH deployments can exhaust a bounded worker pool. This issue is fixed in versions 3.30.15 and 4.3.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T18:17:49.635Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jline/jline3/security/advisories/GHSA-2v9w-34q6-wpqx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jline/jline3/security/advisories/GHSA-2v9w-34q6-wpqx"
        },
        {
          "name": "https://github.com/jline/jline3/pull/2012",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/pull/2012"
        },
        {
          "name": "https://github.com/jline/jline3/pull/2018",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/pull/2018"
        },
        {
          "name": "https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541"
        },
        {
          "name": "https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae"
        },
        {
          "name": "https://github.com/jline/jline3/releases/tag/4.3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/releases/tag/4.3.1"
        },
        {
          "name": "https://github.com/jline/jline3/releases/tag/jline-3.30.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/releases/tag/jline-3.30.15"
        }
      ],
      "source": {
        "advisory": "GHSA-2v9w-34q6-wpqx",
        "discovery": "UNKNOWN"
      },
      "title": "JLine: ReDoS in Built-in Less Viewer Search"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77423",
    "datePublished": "2026-09-23T18:17:49.635Z",
    "dateReserved": "2026-08-20T19:59:59.603Z",
    "dateUpdated": "2026-09-24T14:10:52.736Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77422 (GCVE-0-2026-77422)

Vulnerability from cvelistv5 – Published: 2026-09-23 18:09 – Updated: 2026-09-24 14:13
VLAI
Title
JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping
Summary
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 14:13 UTC
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7620 records in the last 180 days details
References
Impacted products
Vendor Product Version
jline jline3 Affected: >= 3.0.0, < 3.30.15
Affected: >= 4.0.0, < 4.3.1
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77422",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T14:13:32.954382Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T14:13:39.588Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jline3",
          "vendor": "jline",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.30.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java\u0027s backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T18:09:32.308Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw"
        },
        {
          "name": "https://github.com/jline/jline3/pull/2012",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/pull/2012"
        },
        {
          "name": "https://github.com/jline/jline3/pull/2018",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/pull/2018"
        },
        {
          "name": "https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541"
        },
        {
          "name": "https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae"
        },
        {
          "name": "https://github.com/jline/jline3/releases/tag/4.3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/releases/tag/4.3.1"
        },
        {
          "name": "https://github.com/jline/jline3/releases/tag/jline-3.30.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/releases/tag/jline-3.30.15"
        }
      ],
      "source": {
        "advisory": "GHSA-r2xf-8xr9-62gw",
        "discovery": "UNKNOWN"
      },
      "title": "JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77422",
    "datePublished": "2026-09-23T18:09:32.308Z",
    "dateReserved": "2026-08-20T19:59:59.603Z",
    "dateUpdated": "2026-09-24T14:13:39.588Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77421 (GCVE-0-2026-77421)

Vulnerability from cvelistv5 – Published: 2026-09-23 18:07 – Updated: 2026-09-23 19:43
VLAI
Title
JLine: ReDoS in Nano Editor Regex Search Mode
Summary
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearch(String text) in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression engine without a timeout or backtracking bound. A nested-quantifier expression evaluated against non-matching buffer content can consume excessive CPU and indefinitely block the editor session thread, and remote multi-user deployments can lose a worker thread for each affected session. This issue is fixed in versions 3.30.15 and 4.3.1.
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 19:05 UTC
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7620 records in the last 180 days details
References
Impacted products
Vendor Product Version
jline jline3 Affected: >= 3.0.0, < 3.30.15
Affected: >= 4.0.0, < 4.3.1
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77421",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T19:05:07.485942Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T19:43:56.607Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jline3",
          "vendor": "jline",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.30.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor\u0027s regex search mode passes a user-controlled search term from doSearch(String text) in builtins/src/main/java/org/jline/builtins/Nano.java to Java\u0027s backtracking regular expression engine without a timeout or backtracking bound. A nested-quantifier expression evaluated against non-matching buffer content can consume excessive CPU and indefinitely block the editor session thread, and remote multi-user deployments can lose a worker thread for each affected session. This issue is fixed in versions 3.30.15 and 4.3.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T18:07:21.134Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jline/jline3/security/advisories/GHSA-ph9c-7hw9-vhhw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jline/jline3/security/advisories/GHSA-ph9c-7hw9-vhhw"
        },
        {
          "name": "https://github.com/jline/jline3/pull/2012",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/pull/2012"
        },
        {
          "name": "https://github.com/jline/jline3/pull/2018",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/pull/2018"
        },
        {
          "name": "https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541"
        },
        {
          "name": "https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae"
        },
        {
          "name": "https://github.com/jline/jline3/releases/tag/4.3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/releases/tag/4.3.1"
        },
        {
          "name": "https://github.com/jline/jline3/releases/tag/jline-3.30.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/releases/tag/jline-3.30.15"
        }
      ],
      "source": {
        "advisory": "GHSA-ph9c-7hw9-vhhw",
        "discovery": "UNKNOWN"
      },
      "title": "JLine: ReDoS in Nano Editor Regex Search Mode"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77421",
    "datePublished": "2026-09-23T18:07:21.134Z",
    "dateReserved": "2026-08-20T19:59:59.603Z",
    "dateUpdated": "2026-09-23T19:43:56.607Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77420 (GCVE-0-2026-77420)

Vulnerability from cvelistv5 – Published: 2026-09-23 18:11 – Updated: 2026-09-29 02:05
VLAI
Title
JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable
Summary
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORY_IGNORE configuration value into a Java regular expression while escaping only part of its syntax, allowing other regex metacharacters to reach the backtracking engine. An attacker who can control application or user configuration can supply a nested-quantifier expression that is reevaluated whenever a command is added to history, consuming excessive CPU and indefinitely blocking the reader thread. This issue is fixed in versions 3.30.15 and 4.3.1.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 02:05 UTC
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7620 records in the last 180 days details
References
Impacted products
Vendor Product Version
jline jline3 Affected: >= 3.0.0, < 3.30.15
Affected: >= 4.0.0, < 4.3.1
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77420",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T02:05:00.790615Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T02:05:26.410Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jline3",
          "vendor": "jline",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.30.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORY_IGNORE configuration value into a Java regular expression while escaping only part of its syntax, allowing other regex metacharacters to reach the backtracking engine. An attacker who can control application or user configuration can supply a nested-quantifier expression that is reevaluated whenever a command is added to history, consuming excessive CPU and indefinitely blocking the reader thread. This issue is fixed in versions 3.30.15 and 4.3.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T18:11:25.998Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3"
        },
        {
          "name": "https://github.com/jline/jline3/pull/2012",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/pull/2012"
        },
        {
          "name": "https://github.com/jline/jline3/pull/2018",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/pull/2018"
        },
        {
          "name": "https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541"
        },
        {
          "name": "https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae"
        },
        {
          "name": "https://github.com/jline/jline3/releases/tag/4.3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/releases/tag/4.3.1"
        },
        {
          "name": "https://github.com/jline/jline3/releases/tag/jline-3.30.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/releases/tag/jline-3.30.15"
        }
      ],
      "source": {
        "advisory": "GHSA-5q95-hrpc-m3w3",
        "discovery": "UNKNOWN"
      },
      "title": "JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77420",
    "datePublished": "2026-09-23T18:11:25.998Z",
    "dateReserved": "2026-08-20T19:59:59.603Z",
    "dateUpdated": "2026-09-29T02:05:26.410Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77387 (GCVE-0-2026-77387)

Vulnerability from cvelistv5 – Published: 2026-10-01 16:38 – Updated: 2026-10-01 17:50
VLAI
Title
geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point
Summary
geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.from_string() can spend excessive CPU time due to inefficient regular-expression behavior when an application passes a long malformed coordinate string without the 256-character input limit used by the fix. Geocoder reverse methods also reach the vulnerable parsing path when called with string inputs. Repeated attacker-controlled requests can cause a denial of service, while the numeric Point constructor is unaffected. This issue is fixed in version 2.5.0.
Severity
4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 17:50 UTC
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7620 records in the last 180 days details
References
Impacted products
Vendor Product Version
geopy geopy Affected: < 2.5.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77387",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-01T17:50:15.527973Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-01T17:50:39.404Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/geopy/geopy/issues/608"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "geopy",
          "vendor": "geopy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.from_string() can spend excessive CPU time due to inefficient regular-expression behavior when an application passes a long malformed coordinate string without the 256-character input limit used by the fix. Geocoder reverse methods also reach the vulnerable parsing path when called with string inputs. Repeated attacker-controlled requests can cause a denial of service, while the numeric Point constructor is unaffected. This issue is fixed in version 2.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-01T16:38:54.176Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/geopy/geopy/security/advisories/GHSA-mhvh-fq92-pfmr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/geopy/geopy/security/advisories/GHSA-mhvh-fq92-pfmr"
        },
        {
          "name": "https://github.com/geopy/geopy/issues/608",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/geopy/geopy/issues/608"
        },
        {
          "name": "https://github.com/geopy/geopy/pull/610",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/geopy/geopy/pull/610"
        },
        {
          "name": "https://github.com/geopy/geopy/commit/5d09fa843f90ec80788b61552539c9fd3ae6c528",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/geopy/geopy/commit/5d09fa843f90ec80788b61552539c9fd3ae6c528"
        },
        {
          "name": "https://github.com/geopy/geopy/releases/tag/2.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/geopy/geopy/releases/tag/2.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-mhvh-fq92-pfmr",
        "discovery": "UNKNOWN"
      },
      "title": "geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77387",
    "datePublished": "2026-10-01T16:38:54.176Z",
    "dateReserved": "2026-08-20T19:36:13.806Z",
    "dateUpdated": "2026-10-01T17:50:39.404Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77082 (GCVE-0-2026-77082)

Vulnerability from cvelistv5 – Published: 2026-08-20 11:21 – Updated: 2026-08-21 16:42
VLAI
Title
n8n before 1.123.69 ReDoS via Filter and Switch Node
Summary
n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp() and execute them synchronously on the worker thread without complexity validation or execution timeout. A crafted regex pattern can block the worker for an extended period per data item processed, delaying other workflow executions on the same worker.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 16:42 UTC
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6476 records in the last 180 days details
References
Impacted products
Vendor Product Version
n8n-io n8n Affected: 0 , < 1.123.69 (semver)
Unaffected: 1.123.69 (semver)
Create a notification for this product.
n8n-io n8n Affected: 2.34.0 , < 2.34.1 (semver)
Unaffected: 2.34.1 (semver)
Create a notification for this product.
n8n-io n8n Affected: 2.0.0 , < 2.33.4 (semver)
Unaffected: 2.33.4 (semver)
Create a notification for this product.
Date Public
2026-08-05 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77082",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T16:42:22.971498Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T16:42:34.601Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/n8n",
          "product": "n8n",
          "vendor": "n8n-io",
          "versions": [
            {
              "lessThan": "1.123.69",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.123.69",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/n8n",
          "product": "n8n",
          "vendor": "n8n-io",
          "versions": [
            {
              "lessThan": "2.34.1",
              "status": "affected",
              "version": "2.34.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.34.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/n8n",
          "product": "n8n",
          "vendor": "n8n-io",
          "versions": [
            {
              "lessThan": "2.33.4",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.33.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.123.69",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.34.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.33.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-08-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp() and execute them synchronously on the worker thread without complexity validation or execution timeout. A crafted regex pattern can block the worker for an extended period per data item processed, delaying other workflow executions on the same worker."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T11:21:22.151Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-q3fv-295f-qfpf)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-q3fv-295f-qfpf"
        },
        {
          "name": "VulnCheck Advisory: n8n before 1.123.69 ReDoS via Filter and Switch Node",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/n8n-before-redos-via-filter-and-switch-node"
        }
      ],
      "title": "n8n before 1.123.69 ReDoS via Filter and Switch Node",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-77082",
    "datePublished": "2026-08-20T11:21:13.700Z",
    "dateReserved": "2026-08-20T10:55:09.093Z",
    "dateUpdated": "2026-08-21T16:42:34.601Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation
Architecture and Design

Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.

Mitigation
System Configuration

Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.

Mitigation
Implementation

Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.

Mitigation
Implementation

Limit the length of the input that the regular expression will process.

CAPEC-492: Regular Expression Exponential Blowup

An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.

← Back to the CWE list