CWE-185
Allowed-with-ReviewIncorrect Regular Expression
Abstraction: Class · Status: Draft
The product specifies a regular expression in a way that causes data to be improperly matched or compared.
77 vulnerabilities reference this CWE, most recent first.
GHSA-7J2X-32W6-P43P
Vulnerability from github – Published: 2026-03-20 20:35 – Updated: 2026-03-25 20:53Summary
The ensureSize() function in @dicebear/converter used a regex-based approach to rewrite SVG width/height attributes, capping them at 2048px to prevent denial of service. This size capping could be bypassed by crafting SVG input that causes the regex to match a non-functional occurrence of <svg before the actual SVG root element. When the SVG is subsequently rendered via @resvg/resvg-js on the Node.js code path, it renders at the attacker-specified dimensions, potentially causing out-of-memory crashes.
Details
The vulnerable function used String.prototype.replace() with a non-global regex to find and rewrite the first <svg tag's dimensions. Since the regex does not distinguish between <svg appearing inside non-element XML constructs and the actual SVG root element, a crafted input can cause the regex to match a decoy instead of the real element, leaving the actual SVG dimensions unclamped.
In the Node.js rendering path, renderAsync from @resvg/resvg-js was called without a fitTo constraint, so it would render at whatever dimensions the SVG element specified — potentially allocating gigabytes of memory.
The browser code path is not vulnerable because it uses the clamped size return value from ensureSize() to set canvas.width and canvas.height directly.
Impact
Any application that passes untrusted or user-supplied SVG content through @dicebear/converter's Node.js conversion functions (toPng, toJpeg, toWebp, toAvif) is vulnerable to denial of service via excessive memory allocation. Note that @dicebear/converter can be used independently of DiceBear's avatar generation — any SVG string can be passed to the conversion functions.
The impact is limited to availability — there is no data disclosure or integrity impact. The browser code path is not affected.
Fix
The regex-based approach has been replaced with XML-aware processing using fast-xml-parser to correctly identify and modify the SVG root element's attributes. Additionally, a fitTo constraint has been added to the renderAsync call as defense-in-depth, ensuring the rendered output is always bounded regardless of SVG content.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 9.4.1"
},
"package": {
"ecosystem": "npm",
"name": "@dicebear/converter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.4.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33418"
],
"database_specific": {
"cwe_ids": [
"CWE-185"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-20T20:35:40Z",
"nvd_published_at": "2026-03-24T14:16:30Z",
"severity": "HIGH"
},
"details": "## Summary\n\nThe `ensureSize()` function in `@dicebear/converter` used a regex-based approach to rewrite SVG `width`/`height` attributes, capping them at 2048px to prevent denial of service. This size capping could be bypassed by crafting SVG input that causes the regex to match a non-functional occurrence of `\u003csvg` before the actual SVG root element. When the SVG is subsequently rendered via `@resvg/resvg-js` on the Node.js code path, it renders at the attacker-specified dimensions, potentially causing out-of-memory crashes.\n\n## Details\n\nThe vulnerable function used `String.prototype.replace()` with a non-global regex to find and rewrite the first `\u003csvg` tag\u0027s dimensions. Since the regex does not distinguish between `\u003csvg` appearing inside non-element XML constructs and the actual SVG root element, a crafted input can cause the regex to match a decoy instead of the real element, leaving the actual SVG dimensions unclamped.\n\nIn the Node.js rendering path, `renderAsync` from `@resvg/resvg-js` was called without a `fitTo` constraint, so it would render at whatever dimensions the SVG element specified \u2014 potentially allocating gigabytes of memory.\n\nThe browser code path is **not** vulnerable because it uses the clamped `size` return value from `ensureSize()` to set `canvas.width` and `canvas.height` directly.\n\n## Impact\n\nAny application that passes untrusted or user-supplied SVG content through `@dicebear/converter`\u0027s Node.js conversion functions (`toPng`, `toJpeg`, `toWebp`, `toAvif`) is vulnerable to denial of service via excessive memory allocation. Note that `@dicebear/converter` can be used independently of DiceBear\u0027s avatar generation \u2014 any SVG string can be passed to the conversion functions.\n\nThe impact is limited to availability \u2014 there is no data disclosure or integrity impact. The browser code path is not affected.\n\n## Fix\n\nThe regex-based approach has been replaced with XML-aware processing using `fast-xml-parser` to correctly identify and modify the SVG root element\u0027s attributes. Additionally, a `fitTo` constraint has been added to the `renderAsync` call as defense-in-depth, ensuring the rendered output is always bounded regardless of SVG content.",
"id": "GHSA-7j2x-32w6-p43p",
"modified": "2026-03-25T20:53:40Z",
"published": "2026-03-20T20:35:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/dicebear/dicebear/security/advisories/GHSA-7j2x-32w6-p43p"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33418"
},
{
"type": "PACKAGE",
"url": "https://github.com/dicebear/dicebear"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "SVG Dimension Capping Bypass via XML Comment Injection in @dicebear/converter ensureSize()"
}
GHSA-7V9P-34R2-Q668
Vulnerability from github – Published: 2022-05-24 17:30 – Updated: 2023-10-27 11:36Jenkins Audit Trail Plugin uses regular expressions to match requested URLs whose dispatch should be logged.
In Jenkins Audit Trail Plugin 3.6 and earlier, the default regular expression pattern could be bypassed in many cases by adding a suffix to the URL that would be ignored during request handling.
Jenkins Audit Trail Plugin 3.7 changes the default regular expression pattern so that it allows for arbitrary suffixes. It automatically will replace previous default patterns with the new, more complete default pattern.
Additionally, an administrative monitor is shown if a user-specified pattern is found to be bypassable through crafted URLs and form validation was improved to recognize patterns that would not match requests with arbitrary suffixes.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:audit-trail"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-2288"
],
"database_specific": {
"cwe_ids": [
"CWE-185"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-21T16:49:28Z",
"nvd_published_at": "2020-10-08T13:15:00Z",
"severity": "MODERATE"
},
"details": "Jenkins Audit Trail Plugin uses regular expressions to match requested URLs whose dispatch should be logged.\n\nIn Jenkins Audit Trail Plugin 3.6 and earlier, the default regular expression pattern could be bypassed in many cases by adding a suffix to the URL that would be ignored during request handling.\n\nJenkins Audit Trail Plugin 3.7 changes the default regular expression pattern so that it allows for arbitrary suffixes. It automatically will replace previous default patterns with the new, more complete default pattern.\n\nAdditionally, an administrative monitor is shown if a user-specified pattern is found to be bypassable through crafted URLs and form validation was improved to recognize patterns that would not match requests with arbitrary suffixes.",
"id": "GHSA-7v9p-34r2-q668",
"modified": "2023-10-27T11:36:00Z",
"published": "2022-05-24T17:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2288"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/audit-trail-plugin/commit/43433147bec001f13536534d3d282ce3c28b26be"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/audit-trail-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2020-10-08/#SECURITY-1846"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/10/08/5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Incorrect default pattern in Jenkins Audit Trail Plugin"
}
GHSA-8454-MW8R-4MJQ
Vulnerability from github – Published: 2025-03-04 15:31 – Updated: 2025-11-03 21:33It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was not expecting it. This vulnerability affects Firefox < 136 and Firefox ESR < 128.8.
{
"affected": [],
"aliases": [
"CVE-2025-1934"
],
"database_specific": {
"cwe_ids": [
"CWE-185"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-04T14:15:38Z",
"severity": "MODERATE"
},
"details": "It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was not expecting it. This vulnerability affects Firefox \u003c 136 and Firefox ESR \u003c 128.8.",
"id": "GHSA-8454-mw8r-4mjq",
"modified": "2025-11-03T21:33:04Z",
"published": "2025-03-04T15:31:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1934"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1942881"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00006.html"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-14"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-16"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-17"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-18"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8462-Q7X7-G2X4
Vulnerability from github – Published: 2018-09-17 20:44 – Updated: 2023-09-05 23:09The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS) in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString() function is called to parse a long untrusted string.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "bson"
},
"ranges": [
{
"events": [
{
"introduced": "0.5.0"
},
{
"fixed": "1.0.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-13863"
],
"database_specific": {
"cwe_ids": [
"CWE-185",
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:24:09Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS) in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString() function is called to parse a long untrusted string.",
"id": "GHSA-8462-q7x7-g2x4",
"modified": "2023-09-05T23:09:22Z",
"published": "2018-09-17T20:44:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13863"
},
{
"type": "WEB",
"url": "https://github.com/mongodb/js-bson/commit/bd61c45157c53a1698ff23770160cf4783e9ea4a"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-8462-q7x7-g2x4"
},
{
"type": "PACKAGE",
"url": "https://github.com/mongodb/js-bson"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/npm:bson:20180225"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "js-bson vulnerable to REDoS"
}
GHSA-8H5J-7XVQ-97FQ
Vulnerability from github – Published: 2022-05-14 01:49 – Updated: 2022-05-14 01:49An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code execution. This is exploitable by authenticated users who have local filesystem access.
{
"affected": [],
"aliases": [
"CVE-2018-17984"
],
"database_specific": {
"cwe_ids": [
"CWE-185"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-10-04T23:29:00Z",
"severity": "HIGH"
},
"details": "An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code execution. This is exploitable by authenticated users who have local filesystem access.",
"id": "GHSA-8h5j-7xvq-97fq",
"modified": "2022-05-14T01:49:19Z",
"published": "2022-05-14T01:49:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17984"
},
{
"type": "WEB",
"url": "https://0x09al.github.io/security/ispconfig/exploit/vulnerability/2018/08/20/bug-or-backdoor-ispconfig-rce.html"
},
{
"type": "WEB",
"url": "https://github.com/0x09AL/0x09al.github.io/blob/master/_posts/2018-08-20-bug-or-backdoor-ispconfig-rce.markdown"
},
{
"type": "WEB",
"url": "https://www.ispconfig.org/blog/ispconfig-3-1-13-released-important-security-bugfix"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-93PH-P7V4-HWH4
Vulnerability from github – Published: 2026-02-09 17:19 – Updated: 2026-02-09 22:38Summary
AllowedHosts host validation can be bypassed because configured host patterns are turned into regular expressions without escaping regex metacharacters (notably .). A configured allowlist entry like example.com can match exampleXcom
Details
In litestar.middleware.allowed_hosts, allowlist entries are compiled into regex patterns in a way that allows regex metacharacters to retain special meaning (e.g., . matches any character). This enables a bypass where an attacker supplies a host that matches the regex but is not the intended literal hostname.
PoC
Server (poc_allowed_hosts_server.py)
from litestar import Litestar, get
from litestar.middleware.allowed_hosts import AllowedHostsConfig
@get("/")
async def index() -> str:
return "ok"
config = AllowedHostsConfig(allowed_hosts=["example.com"])
app = Litestar([index], allowed_hosts_config=config)
uvicorn poc_allowed_hosts_server:app --host 127.0.0.1 --port 8001
Client (poc_allowed_hosts_client.py)
import http.client
def req(host_header: str) -> tuple[int, bytes]:
c = http.client.HTTPConnection("127.0.0.1", 8001, timeout=3)
c.request("GET", "/", headers={"Host": host_header})
r = c.getresponse()
body = r.read()
c.close()
return r.status, body
print("evil.com:", *req("evil.com"))
print("exampleXcom:", *req("exampleXcom"))
Expected (vulnerable behavior): Host: evil.com → 400 invalid host
Host: exampleXcom → 200 ok (bypass)
Impact
Type: security control bypass (host allowlist) Who is impacted: apps relying on AllowedHosts to prevent Host header attacks (cache poisoning, absolute URL construction abuse, password reset link poisoning, etc.). The downstream impact depends on app behavior, but the bypass defeats a core mitigation layer.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "litestar"
},
"ranges": [
{
"events": [
{
"introduced": "2.19.0"
},
{
"fixed": "2.20.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.19.0"
]
}
],
"aliases": [
"CVE-2026-25479"
],
"database_specific": {
"cwe_ids": [
"CWE-185"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-09T17:19:00Z",
"nvd_published_at": "2026-02-09T20:15:57Z",
"severity": "MODERATE"
},
"details": "### Summary\nAllowedHosts host validation can be bypassed because configured host patterns are turned into regular expressions without escaping regex metacharacters (notably .). A configured allowlist entry like example.com can match exampleXcom\n\n### Details\nIn litestar.middleware.allowed_hosts, allowlist entries are compiled into regex patterns in a way that allows regex metacharacters to retain special meaning (e.g., . matches any character). This enables a bypass where an attacker supplies a host that matches the regex but is not the intended literal hostname.\n\n### PoC\nServer (poc_allowed_hosts_server.py)\n\n```\nfrom litestar import Litestar, get\nfrom litestar.middleware.allowed_hosts import AllowedHostsConfig\n\n@get(\"/\")\nasync def index() -\u003e str:\n return \"ok\"\n\nconfig = AllowedHostsConfig(allowed_hosts=[\"example.com\"])\napp = Litestar([index], allowed_hosts_config=config)\n```\n\n`uvicorn poc_allowed_hosts_server:app --host 127.0.0.1 --port 8001`\n\nClient (poc_allowed_hosts_client.py)\n\n```\nimport http.client\n\ndef req(host_header: str) -\u003e tuple[int, bytes]:\n c = http.client.HTTPConnection(\"127.0.0.1\", 8001, timeout=3)\n c.request(\"GET\", \"/\", headers={\"Host\": host_header})\n r = c.getresponse()\n body = r.read()\n c.close()\n return r.status, body\n\nprint(\"evil.com:\", *req(\"evil.com\"))\nprint(\"exampleXcom:\", *req(\"exampleXcom\"))\n```\n\nExpected (vulnerable behavior):\nHost: evil.com \u2192 400 invalid host\n\nHost: exampleXcom \u2192 200 ok (bypass)\n\n### Impact\nType: security control bypass (host allowlist)\nWho is impacted: apps relying on AllowedHosts to prevent Host header attacks (cache poisoning, absolute URL construction abuse, password reset link poisoning, etc.). The downstream impact depends on app behavior, but the bypass defeats a core mitigation layer.",
"id": "GHSA-93ph-p7v4-hwh4",
"modified": "2026-02-09T22:38:10Z",
"published": "2026-02-09T17:19:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/litestar-org/litestar/security/advisories/GHSA-93ph-p7v4-hwh4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25479"
},
{
"type": "WEB",
"url": "https://github.com/litestar-org/litestar/commit/06b36f481d1bfea6f19995cfb4f203aba45c4ace"
},
{
"type": "WEB",
"url": "https://docs.litestar.dev/2/release-notes/changelog.html#2.20.0"
},
{
"type": "PACKAGE",
"url": "https://github.com/litestar-org/litestar"
},
{
"type": "WEB",
"url": "https://github.com/litestar-org/litestar/releases/tag/v2.20.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Litestar\u0027s AllowedHosts has a validation bypass due to unescaped regex metacharacters in configured host patterns"
}
GHSA-9GCG-W975-3RJH
Vulnerability from github – Published: 2026-04-16 20:44 – Updated: 2026-04-16 20:44Impact
The serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots (.) as a regular expression matcher. Because . is a valid character in a service account name, an AuthorizationPolicy ALLOW rule targeting SA e.g. cert-manager.io also matches cert-manager-io, cert-managerXio, etc. A DENY rule targeting the same name fails to block those variants.
Patches
Fixes are available in 1.29.2, 1.28.6, and 1.27.9
Workarounds
None
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "istio.io/istio"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.0-20241024090207-0bf27d49ba4b"
},
{
"fixed": "0.0.0-20260403004500-692e460c342d"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-39350"
],
"database_specific": {
"cwe_ids": [
"CWE-185"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-16T20:44:46Z",
"nvd_published_at": "2026-04-15T23:16:09Z",
"severity": "MODERATE"
},
"details": "### Impact\nThe `serviceAccounts` and `notServiceAccounts` fields in AuthorizationPolicy incorrectly interpret dots (`.`) as a regular expression matcher. Because `.` is a valid character in a service account name, an `AuthorizationPolicy` ALLOW rule targeting SA e.g. `cert-manager.io` also matches `cert-manager-io`, `cert-managerXio`, etc. A DENY rule targeting the same name fails to block those variants.\n\n### Patches\nFixes are available in 1.29.2, 1.28.6, and 1.27.9\n\n### Workarounds\nNone",
"id": "GHSA-9gcg-w975-3rjh",
"modified": "2026-04-16T20:44:46Z",
"published": "2026-04-16T20:44:46Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/istio/istio/security/advisories/GHSA-9gcg-w975-3rjh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39350"
},
{
"type": "WEB",
"url": "https://github.com/istio/istio/commit/692e460c342d8f308a35b6ecbdace47807da8ade"
},
{
"type": "PACKAGE",
"url": "https://github.com/istio/istio"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Istio: AuthorizationPolicy serviceAccounts regex injection via unescaped dots"
}
GHSA-9P3Q-P26Q-FXXC
Vulnerability from github – Published: 2026-09-10 21:31 – Updated: 2026-09-10 21:31Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not authorized to access. When building Envoy RBAC rules to enforce Connect intentions, Consul did not correctly escape certain characters in service names, namespaces, and partitions, causing the generated authorization rules to match more broadly than intended. This vulnerability (CVE-2026-88021) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.
{
"affected": [],
"aliases": [
"CVE-2026-88021"
],
"database_specific": {
"cwe_ids": [
"CWE-185"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-10T19:17:39Z",
"severity": "HIGH"
},
"details": "Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not authorized to access. When building Envoy RBAC rules to enforce Connect intentions, Consul did not correctly escape certain characters in service names, namespaces, and partitions, causing the generated authorization rules to match more broadly than intended. This vulnerability (CVE-2026-88021) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.",
"id": "GHSA-9p3q-p26q-fxxc",
"modified": "2026-09-10T21:31:35Z",
"published": "2026-09-10T21:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88021"
},
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2026-37-consul-vulnerable-to-an-authorization-bypass-in-the-connect-service-mesh/77739"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9PQ7-RCXV-47VQ
Vulnerability from github – Published: 2021-07-14 19:10 – Updated: 2021-07-15 20:24RestSharp < 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTimes. If a server responds with a malicious string, the client using RestSharp will be stuck processing it for an exceedingly long time. Thus the remote server can trigger Denial of Service.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 106.11.7"
},
"package": {
"ecosystem": "NuGet",
"name": "RestSharp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "106.11.8-alpha.0.13"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-27293"
],
"database_specific": {
"cwe_ids": [
"CWE-185",
"CWE-697"
],
"github_reviewed": true,
"github_reviewed_at": "2021-07-13T21:24:43Z",
"nvd_published_at": "2021-07-12T11:15:00Z",
"severity": "HIGH"
},
"details": "RestSharp \u003c 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTimes. If a server responds with a malicious string, the client using RestSharp will be stuck processing it for an exceedingly long time. Thus the remote server can trigger Denial of Service.",
"id": "GHSA-9pq7-rcxv-47vq",
"modified": "2021-07-15T20:24:43Z",
"published": "2021-07-14T19:10:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27293"
},
{
"type": "WEB",
"url": "https://github.com/restsharp/RestSharp/issues/1556"
},
{
"type": "WEB",
"url": "https://github.com/restsharp/RestSharp/commit/be39346784b68048b230790d15333574341143bc"
},
{
"type": "WEB",
"url": "https://restsharp.dev"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Incorrect Regular Expression in RestSharp"
}
GHSA-FX7M-J728-MJW3
Vulnerability from github – Published: 2019-03-06 17:35 – Updated: 2023-01-23 17:07An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "uap-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-20164"
],
"database_specific": {
"cwe_ids": [
"CWE-185"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:35:45Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)",
"id": "GHSA-fx7m-j728-mjw3",
"modified": "2023-01-23T17:07:55Z",
"published": "2019-03-06T17:35:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20164"
},
{
"type": "WEB",
"url": "https://github.com/ua-parser/uap-core/issues/332"
},
{
"type": "WEB",
"url": "https://github.com/ua-parser/uap-core/commit/010ccdc7303546cd22b9da687c29f4a996990014"
},
{
"type": "WEB",
"url": "https://github.com/ua-parser/uap-core/commit/156f7e12b215bddbaf3df4514c399d683e6cdadc"
},
{
"type": "PACKAGE",
"url": "https://github.com/ua-parser/uap-core"
},
{
"type": "WEB",
"url": "https://www.x41-dsec.de/lab/advisories/x41-2018-009-uaparser"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "uap-core Regular Expression Denial of Service issue"
}
Mitigation MIT-45
Strategy: Refactoring
Regular expressions can become error prone when defining a complex language even for those experienced in writing grammars. Determine if several smaller regular expressions simplify one large regular expression. Also, subject the regular expression to thorough testing techniques such as equivalence partitioning, boundary value analysis, and robustness. After testing and a reasonable confidence level is achieved, a regular expression may not be foolproof. If an exploit is allowed to slip through, then record the exploit and refactor the regular expression.
CAPEC-15: Command Delimiters
An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or denylist input validation, as opposed to allowlist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or denylist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on.
CAPEC-6: Argument Injection
An attacker changes the behavior or state of a targeted application through injecting data or command syntax through the targets use of non-validated and non-filtered arguments of exposed services or methods.
CAPEC-79: Using Slashes in Alternate Encoding
This attack targets the encoding of the Slash characters. An adversary would try to exploit common filtering problems related to the use of the slashes characters to gain access to resources on the target host. Directory-driven systems, such as file systems and databases, typically use the slash character to indicate traversal between directories or other container components. For murky historical reasons, PCs (and, as a result, Microsoft OSs) choose to use a backslash, whereas the UNIX world typically makes use of the forward slash. The schizophrenic result is that many MS-based systems are required to understand both forms of the slash. This gives the adversary many opportunities to discover and abuse a number of common filtering problems. The goal of this pattern is to discover server software that only applies filters to one version, but not the other.