CVE-2026-116588 is a high-severity vulnerability in DataDog's dd-trace-py Python APM client affecting versions from 1.5.0 up to but not including 3.19.9 and from 4.0.0 up to but not including 4.15.6. The issue involves an inefficient regular expression used by default for query-string obfuscation that can cause excessive backtracking when processing attacker-controlled URL query strings. This can lead to prolonged CPU consumption, increased request latency, and potential service unavailability in HTTP tracing integrations that include query strings in span tags. The vulnerability is fixed in versions 3.19.9 and 4.15.6.
CVE-2026-115822 is a vulnerability in Starman versions before 0.4019 for Perl that allows remote attackers to cause CPU exhaustion via inefficient regular expression processing. The flaw arises from quadratic regex backtracking when parsing chunked HTTP request bodies, specifically due to a regex that fails to match lines with a bare LF followed by CRLF, leading to excessive backtracking. This can exhaust worker CPU resources by sending specially crafted requests.
A vulnerability in graphql-scalars' GraphQLPhoneNumber scalar causes inefficient regular expression complexity leading to exponential backtracking. This can block the Node.js event loop and stall the server when processing certain unauthenticated requests. The issue affects versions from 1.24.1 up to but not including 2.0.1 and is fixed in version 2.0.1.
A resource consumption vulnerability exists in open-telemetry opentelemetry-python prior to version 1.45.1. The TraceState.from_header function parses W3C tracestate headers using an unbounded optional-whitespace regular expression, which can cause excessive CPU usage due to quadratic backtracking when processing malformed headers with long runs of spaces or tabs. This can degrade availability by occupying synchronous workers or delaying asynchronous event loop requests. The vulnerability does not expose or modify telemetry data and does not allow code execution. It is fixed in version 1.45.1.
```
============================================================================
ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
Location: src/PIL/XbmImagePlugin.py:58 in XbmImageFile._open()
Commit: a707c6b21c313880d0771e54965d142dd42358b6
============================================================================
```
A crafted 512-byte file makes Pillow's `Image.open()` spend about six minutes of processor time on one core before it gives up with `UnidentifiedImageError`. Anyone who can hand bytes to an application that opens images with Pillow's default settings can trigger this, for example through an upload form, a thumbnailer, or a service that checks whether a blob is an image. A few such files sent at once can tie up a typical pool of worker processes.
The cause is the `xbm_head` regular expression in `src/PIL/XbmImagePlugin.py:32-40`, which `XbmImageFile._open()` (line 58) runs over the first 512 bytes of any stream whose prefix starts with `#define`. Several adjacent parts of the pattern can match the same characters. `[ \t]+` overlaps with `.*` in the width and height lines and with `[^_]*` in the optional hotspot lines, and `[\r\n]+` closing the hotspot group overlaps with the following `[\000-\377]*`. The header sets a run of k spaces after each `#define` and a run of k line terminators after `_y_hot`, then omits the `[]` after `_bits`. That forces Python's backtracking matcher to try every way of splitting those runs and rescan the remaining bytes each time. The cost grows roughly as k to the fifth power: k = 60 measured 375 s, while a well-formed XBM of the same size opens in about 40 ms. Because this happens before any format is identified, none of Pillow's size, pixel-count or decompression-bomb limits apply, and upload size limits do not help because the file is tiny. `ImageFile.Parser.feed()` repeats the cost on every chunk until the stream is identified. The only existing mitigation is passing a `formats=` allowlist that excludes `"XBM"`.
The attached reproducer opens the same header with and without the trailing `[]`. The valid version opens as XBM in 52 ms. The broken version takes 0.1 s, 0.75 s, 3.0 s and 8.6 s at k = 10, 15, 20 and 25, and the slow k = 60 case is not run. This is the same class of bug as CVE-2021-25292 in `PdfParser`, but in a different plugin and reachable from plain `Image.open()`.
## Details
`XbmImageFile._open()` identifies an XBM file by running the module-level regex `xbm_head` over the first 512 bytes of the stream. The pattern has several adjacent quantifier pairs that can consume the same characters, followed by a `[\000-\377]*_bits\[]` tail that rescans the rest of the buffer for every way of splitting them. A 512-byte input built to exercise all of them and then fail the final literal keeps `Image.open()` in `xbm_head.match()` for minutes before it raises `UnidentifiedImageError`.
This 512-byte input (k = 60) takes 375 s of CPU in `Image.open(io.BytesIO(data))` with default settings, measured on the stock build at this commit:
```python
k = 60
data = b"#define" + b" "*k + b"_width 1\r"
data += b"#define" + b" "*k + b"_height 1\r"
data += b"#define" + b" "*k + b"_x_hot 1\r"
data += b"#define" + b" "*k + b"_y_hot 1" + b"\r"*k
data += b"_bits" # no "[]": the final literal never matches
data += b"A" * (512 - len(data)) # pad to the 512 bytes _open() reads
```
Calling `XbmImagePlugin.xbm_head.match(data)` directly gives the same picture: k = 10 → 0.11 s, k = 15 → 0.76 s, k = 20 → 3.0 s, k = 25 → 8.5 s, k = 30 → 19.9 s (roughly ×27 per doubling of k, i.e. about k^4.7). A well-formed 512-byte XBM matches in 10 µs and opens and loads through `Image.open()` in ~40 ms including plugin import; the same k = 60 header with `_bits[]` present matches in 5 µs.
The regex, `src/PIL/XbmImagePlugin.py:32`:
```python
xbm_head = re.compile(
rb"\s*#define[ \t]+.*_width[ \t]+(?P<width>[0-9]+)[\r\n]+"
b"#define[ \t]+.*_height[ \t]+(?P<height>[0-9]+)[\r\n]+"
b"(?P<hotspot>"
b"#define[ \t]+[^_]*_x_hot[ \t]+(?P<xhot>[0-9]+)[\r\n]+"
b"#define[ \t]+[^_]*_y_hot[ \t]+(?P<yhot>[0-9]+)[\r\n]+"
b")?"
rb"[\000-\377]*_bits\[]"
)
```
and the only call site, `src/PIL/XbmImagePlugin.py:58`:
```python
def _open(self) -> None:
…
m = xbm_head.match(self.fp.read(512))
if not m:
msg = "not a XBM file"
raise SyntaxError(msg)
```
For a well-formed header (`#define im_width 8\n…static char im_bits[] = {`) each `[ \t]+` eats the single space, `.*`/`[^_]*` eat the identifier prefix, and `[\000-\377]*_bits\[]` finds the literal on its first backward scan, so the match is linear. The crafted header diverges at every one of those points:
- `[ \t]+.*_width` and `[ \t]+.*_height`: the run of k spaces after `#define` can be split between `[ \t]+` and `.*` in k ways, all leading to the same continuation. Factor k each. (The choice of `\r` terminators is incidental: t
A vulnerability in the beaugunderson ip-address library before version 10.7.4 allows denial of service via inefficient regular expression complexity. Specifically, input containing many '%' characters can cause excessive CPU consumption and application stalls when processed by the Address6 constructor.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout when an authenticated user stores a catastrophic-backtracking regex and any user in the same Space imports a matching recipe. Request processing uses Automation.param_2, apply_regex_replace_automation, sub, api/recipe-from-source/. The attack works because the shared-Space automation engine evaluates the malicious pattern during recipe import and can occupy a Gunicorn worker until its request timeout. This can exhaust application worker slots and make the service unavailable to users. This issue is fixed in version 2.6.10.
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an attacker-controlled route parameter, a long slug ending in a character rejected by the final assertion causes quadratic backtracking and excessive CPU use. Route matching occurs before route and group middleware, so authentication or rate-limiting middleware attached to the route may not prevent an unauthenticated request from blocking the Node.js event loop and stopping the worker from serving unrelated requests or health checks. This issue is fixed in versions 8.2.2 and 9.1.1.
CVE-2026-108082 is a high-severity vulnerability in the Symfony PHP framework affecting multiple versions prior to 5.4.54, 6.4.46, 7.4.19, and 8.1.7. The issue arises from inefficient regular expression complexity in HeaderUtils::split(), which processes HTTP header values. This can cause exponential backtracking when parsing headers with runs of whitespace before separators, leading to high CPU usage and denial of service. The vulnerability is reachable without authentication via crafted HTTP requests. From 18 spaces onward, the regex engine hits backtrack limits, causing header directives to be silently dropped.
Satel Netco Design versions prior to v2.1.7 contains an inefficient regular expression complexity vulnerability. An authenticated user with Viewer privileges could submit crafted search input that causes excessive processing, potentially degrading the availability of the application.
CVE-2026-107290 is a vulnerability in pydantic-ai affecting versions from 1.77.0 up to but not including 1.107.6, and from 2.0.0b1 up to but not including 2.44.0. It involves inefficient regular expression complexity in the local web_fetch_tool and WebFetch local fallback process, which process server-controlled responses with quadratic time complexity in title extraction, whitespace normalization, and ordered-list numbering. This can cause the event loop to stall for an extended period, impacting other agent runs and requests. The issue is fixed in versions 1.107.6 and 2.44.0.
Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mail services unavailable with their own filter. A ':matches' pattern was matched by a backtracking descent whose time grew with the matched value's length raised to the number of wildcards, so a pattern such as '*a*a*a*b' over 800 characters took 44 seconds; and 'deleteheader' erased the fields it removed one at a time, so removing many fields of one name over a message's header cost O(N^2) (80,000 fields took 18.8 seconds). Sieve filters run on the small, shared delivery thread pool, so an account holder whose active script does this, fed a few messages they can send themselves, empties the pool and stops delivery for the whole server. The script is the account holder's own and cannot be set for another user.
CVE-2026-102408 is a medium severity vulnerability in Elastic Elasticsearch involving inefficient regular expression complexity. The ES|QL CHUNK function accepts user-supplied regular expressions without validating their computational complexity or bounding execution time. An authenticated user with read access to any text-based index can submit crafted regex patterns that cause catastrophic backtracking, leading to excessive CPU consumption and degraded query throughput on affected nodes. The issue results in denial of service conditions but does not crash the cluster.
CVE-2026-106104 is a high-severity vulnerability in the Quasar Framework prior to version 2.23.3. It involves inefficient regular expression complexity in the Platform.parseSSR() function, which processes the User-Agent header during server-side rendering (SSR). An attacker can craft a request with repeated version tokens causing super-linear backtracking in regex evaluation, blocking the Node.js event loop and delaying all SSR requests. This affects only SSR targets; other Quasar targets like SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation are not impacted. The issue is fixed in version 2.23.3.
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type processing to take an extremely long time, resulting in uncontrolled resource consumption. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
CVE-2026-105646 is a vulnerability in TryGhost Ghost versions 4.0.0 up to 6.65.0 that allows an attacker with Administrator access to cause excessive CPU usage via crafted content import files, potentially making the server unresponsive. The issue is fixed in version 6.67.0. The vulnerability has a medium severity with a CVSS score of 4.9.
CVE-2026-105645 is a vulnerability in TryGhost Ghost affecting versions from 5.37.0 up to but not including 6.67.0. It involves inefficient regular expression complexity in the external media inliner component, which can be exploited by an attacker with Administrator access to cause excessive CPU usage and render the Ghost server unresponsive. A fix for this issue is available in version 6.67.0.
probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parse_sync/svg.js and lib/parse_stream/svg.js use the searching regular expression /<[-_.:a-zA-Z0-9][^>]*>/, which repeatedly scans to the end of input when attacker-controlled data contains many less-than characters without a closing greater-than character. The synchronous parser converts and scans the full supplied buffer without an input cap, while the streaming parser reparses the complete accumulated SVG prefix for every received chunk. The probe.sync(), probe(stream), and probe(url) entry points can therefore block the Node.js event loop at full CPU, and attacker-controlled chunking can amplify the streaming cost. This issue is fixed in version 7.4.0.
Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
basic-ftp versions prior to 6.2.1 contain an inefficient regular expression complexity vulnerability in the Client.list() function. A malicious or compromised FTP server can cause the client to spend quadratic CPU time parsing directory listings, leading to event loop blocking and process freezing. This is due to backtracking in the RE_LINE regex when parsing Unix-style directory listings with certain crafted lines. The issue is resolved in version 6.2.1.