CVE-2026-102270 is a Regular Expression Denial of Service (ReDoS) vulnerability in the pyjwt library's is_pem_format function. The vulnerability arises from a regex pattern that exhibits quadratic time complexity when processing malformed PEM-like inputs consisting of repeated '-----BEGIN CERTIFICATE-----' lines without a corresponding '---- END' line. This can cause excessive CPU usage, potentially leading to resource exhaustion and denial of service. The issue affects pyjwt versions prior to 2.14.0. A fix replacing the vulnerable regex with a bounded marker scan was released in pyjwt 2.14.0 on 2026-09-11.
CVE-2026-67419 is a high-severity vulnerability in rabbitmq-server prior to version 4.3.5. It involves inefficient algorithmic complexity in topic exchange routing, where an authenticated user with permissions to bind queues and publish messages can exploit consecutive '#' segments in binding keys. This causes excessive CPU and memory usage due to duplicate processing in topic matchers, potentially disrupting message routing for all tenants. The issue is fixed in version 4.3.5.
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.23, 4.1.14, 4.2.9, and 4.3.3, the optional rabbitmq_jms_topic_exchange plugin's x-jms-topic exchange accepted a client-controlled rjms_erlang_selector binding expression whose LIKE evaluator expanded percent and underscore wildcards into overlapping PCRE fragments. It executed those fragments with raw re:run/3 without match or recursion limits, allowing an authenticated tenant that can bind and publish to consume broker scheduler CPU and deny service with pathological selectors. This issue is fixed in versions 4.0.23, 4.1.14, 4.2.9, and 4.3.3.
Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular expression. An authenticated caller can supply a computationally expensive regular expression that degrades application performance or halts Node.js processes. This issue is fixed in version 5.48.2.
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, match_value/3 passes the user-supplied ?name= regular expression to re:run with no match_limit option, and executes it once per resource in the result set. OTP's default 10M match_limit caps each call at roughly 100-200ms, but the regex runs once per resource in the result set. With a large set, for example 5000 queues at 150ms each, a single request consumes 12 or more minutes of CPU. Parallel requests saturate the schedulers. The use_regex=true option is a supported feature on list endpoints, so this path is reachable through normal API use. Preconditions include Any user with the management tag can exploit this.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, pattern_to_regex maps % -> .*? and _ -> ., then compiles ^...$ with only [unicode]; re:run is called with only [{capture, none}] - no explicit match_limit. A pattern like %_%_..._%X becomes ^.*?..*?.....*?.X$ with overlapping lazy quantifiers. The whole-expression cap is ?MAX_EXPRESSION_LENGTH=4096 chars / ?MAX_TOKENS=200; a LIKE string literal is one token, so ~2000 %_ pairs fit. SQL filters are accepted unconditionally at rabbit_amqp_session.erl:3264 (no feature flag). Evaluated per-message at rabbit_stream_queue.erl:1439. OTP's default 10M match_limit caps each match at ~100-200 ms (not seconds), and the re NIF yields to the scheduler. An authenticated AMQP 1.0 consumer with read+write on a stream queue can cause ~100-200 ms of CPU per delivered message via a crafted LIKE filter, multiplied across thousands of messages and parallel sessions - a substantial backtracking-driven CPU amplification. Preconditions include AMQP 1.0 with stream queues in use Attacker can attach a receiver with a filter (read permission) and publish messages with long property values (write permission). This issue is fixed in versions 4.2.7 and 4.3.1.
JLine3 versions from 3.0.0 up to but not including 3.30.15, and from 4.0.0 up to but not including 4.3.1, contain an inefficient regular expression complexity vulnerability. The built-in less viewer passes user-controlled search and filter patterns directly to Java's backtracking regex engine, which can cause excessive CPU consumption and indefinite blocking of the session thread when processing certain inputs. This can lead to denial of service by exhausting worker threads in Telnet or SSH deployments. The issue is fixed in versions 3.30.15 and 4.3.1.
JLine3 versions from 3.0.0 up to but excluding 3.30.15, and from 4.0.0 up to but excluding 4.3.1, contain an inefficient regular expression complexity vulnerability in the built-in grep command. This vulnerability arises because user-controlled regular expressions are automatically wrapped with dot-star prefixes and suffixes before evaluation, which can cause excessive CPU consumption and indefinite blocking of command workers when processing certain inputs. The issue is fixed in versions 3.30.15 and 4.3.1.
JLine3 versions from 3.0.0 up to but not including 3.30.15, and from 4.0.0 up to but not including 4.3.1, contain an inefficient regular expression complexity vulnerability in the built-in nano editor's regex search mode. This flaw allows a crafted search term to cause excessive CPU consumption and indefinite blocking of the editor session thread due to unbounded backtracking in Java's regex engine. The issue can lead to denial of service by exhausting worker threads in remote multi-user deployments. The vulnerability is fixed in versions 3.30.15 and 4.3.1.
CVE-2026-77420 is a medium severity vulnerability in the jline3 Java library affecting versions from 3.0.0 up to but not including 3.30.15 and from 4.0.0 up to but not including 4.3.1. The flaw arises from inefficient regular expression handling in the DefaultHistory.matchPatterns method, where partial escaping of regex syntax allows nested quantifiers to cause excessive CPU consumption and indefinite blocking of the reader thread. This can be triggered by an attacker controlling application or user configuration. The issue is fixed in versions 3.30.15 and 4.3.1.
CVE-2026-89407 is a high-severity vulnerability in FasterXML jackson-core affecting versions from 2.17.0 through 3.2.1 in specified subranges. It involves inefficient regular expression complexity in the NumberInput.looksLikeValidNumber() method, causing quadratic time complexity when processing certain numeric string inputs. This can lead to denial-of-service conditions by exhausting server resources during JSON deserialization of numeric types. The issue does not exist before version 2.17.0 and has been fixed by replacing the problematic regex with a single-pass scan.
Sync-in Server versions prior to 2.4.0 contain a vulnerability in the sync diff endpoint where user-supplied strings are compiled into regular expressions without complexity validation. This can lead to catastrophic backtracking patterns that block the Node.js event loop, causing the server to become unresponsive until restarted. The issue is patched in version 2.4.0.
CVE-2026-93761 is a high-severity vulnerability in the Mongoid library by MongoDB Inc. It involves inefficient regular expression complexity in the in-memory query evaluation component. An unauthenticated attacker can supply crafted text in a pattern-matching query on embedded associations, causing excessive processing and potentially making the application unresponsive. This affects multiple Mongoid versions from 7.2.0 through 9.1.0 as specified. No known exploits are reported in the wild, and no patch information is provided in the source data.
CVE-2026-85999 is a medium severity vulnerability in the Python library soupsieve (used by BeautifulSoup) that causes uncontrolled resource consumption (quadratic time complexity) when parsing certain valid CSS selectors containing long runs of whitespace or comments. This happens due to an inefficient regular expression search that triggers excessive backtracking, leading to significant CPU usage and interpreter stalls. The issue affects soupsieve versions prior to 2.9. Exploitation requires user-controlled CSS selectors, so applications using only hard-coded selectors are not affected.
CVE-2026-86000 is a medium severity vulnerability in the Python library soupsieve (used by BeautifulSoup) involving uncontrolled resource consumption due to a regular expression backtracking issue. The flaw arises from overlapping quantified character classes in the regex pattern used to parse CSS selectors, causing quadratic time complexity when processing certain crafted selectors that fail to match. This can lead to significant CPU consumption and delays when user-controlled selectors are processed. The vulnerability affects soupsieve versions prior to 2.9. Exploitation requires passing a maliciously crafted CSS selector string to soupsieve or BeautifulSoup's select methods. No known exploits are reported in the wild, and no official patch information is provided in the input data.
Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking pattern through StringOperators.regex. packages/core/src/service/helpers/list-query-builder/parse-filter-params.ts passes the raw pattern to the REGEXP implementation registered by packages/core/src/service/helpers/list-query-builder/list-query-builder.ts, and better-sqlite3 and sqljs evaluate it synchronously in the Node.js event loop. ShopProductsResolver.products is publicly reachable, so one nested-quantifier pattern can block request processing and make the storefront and admin API unavailable, while repeated requests can sustain denial of service. PostgreSQL and MySQL or MariaDB deployments do not execute this regular expression in the Node.js event loop. This issue is fixed in version 3.6.5.
CVE-2026-76821 is a high-severity vulnerability in OpenCTI-Platform's opencti prior to version 7.260706.0. It involves uncontrolled resource consumption due to the JSON ingestion mapper's extractWithRegexp function compiling user-supplied regular expressions without complexity validation. An authenticated user with JSON mapper creation permission can supply a malicious regex causing catastrophic backtracking, blocking the Node.js event loop and making the GraphQL API unavailable. The issue affects availability but does not expose or modify data. The vulnerability is fixed in version 7.260706.0.
DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, a route containing multiple unconstrained parameters in one path segment can cause excessive regular-expression backtracking in DotvvmRoute.IsMatch when a remote requester supplies a long near-match path. DotvvmRouteParser.RouteRegex previously had no matching timeout. Patched runtimes retry with the .NET non-backtracking engine, while runtimes that do not support non-backtracking matching return HTTP 503 after the one-second timeout in DotvvmRoutingMiddleware. This issue is fixed in versions 4.2.11, 4.3.15, and 5.0.0-preview09-final.