CVE-2026-68497 is a high-severity denial of service vulnerability in FasterXML jackson-databind affecting versions >=2.0.0 <2.18.10, >=2.19.0 <2.21.6, >=2.22.0 <2.22.2, >=3.0.0 <3.1.6, and >=3.2.0 <3.2.2. It arises because the library deserializes JSON strings bound to javax.xml.datatype.Duration or XMLGregorianCalendar fields by passing them directly to JDK factory methods that parse numeric components with O(n²) complexity, without enforcing length limits on the string input. This allows an unauthenticated attacker to cause excessive CPU consumption and denial of service by submitting a specially crafted JSON string with very long numeric components. No polymorphic typing or special configuration is required to trigger this issue.
An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation during message delivery attempts, occupying a shared broker thread and leading to denial of service.
This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0.
Users are recommended to upgrade to version 2.57.0, which fixes this issue.
CVE-2026-86081 is a high-severity vulnerability in the n8n workflow automation platform. It involves inefficient regular expression complexity in the Git node clone operation, which uses a regex pattern vulnerable to catastrophic backtracking. An authenticated workflow editor can exploit this to freeze the n8n instance during workflow execution. The issue affects versions prior to 1.123.76, 2.37.7, and 2.38.2 and has been fixed in these versions.
Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and src/colorModels/cmykString.ts use the ambiguous numeric regular expression ([+-]?\d*.?\d+), allowing the same digits to be divided between overlapping quantifiers in quadratically many ways when malformed input is rejected. An attacker who can supply an unbounded color string to colord(), getFormat(), isEqual(), mix(), or contrast(), including through a request body, JSON field, or uploaded stylesheet, can block the processing thread with a multi-kilobyte payload. The affected matchers are parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. This issue is fixed in version 2.9.4.
A regular expression denial of service (ReDoS) vulnerability exists in nodemailer versions before 6.9.9. This flaw occurs during email parsing when the attachDataUrls parameter is enabled or when processing embedded file attachments. An attacker can exploit this by sending specially crafted emails containing malicious data URLs or embedded attachments, causing the event loop to hang and resulting in a denial of service.
CVE-2026-55520 is a high-severity vulnerability in the Protego library, a Python robots.txt parser used by the Scrapy project. Versions prior to 0.6.2 are affected by uncontrolled resource consumption due to exponential backtracking in regular expression matching when processing robots.txt directives containing many asterisks. This can cause denial of service by making the can_fetch method spend an attacker-controlled amount of time matching URLs. The issue is fixed in version 0.6.2.
SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functionality. Successful exploitation could exhaust system resources and make the service unavailable, resulting in a high impact on availability. There is no impact on confidentiality and integrity.
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.5.1 until 3.9.2, an authenticated admin or superadmin can set matchMethod to regex and place a malicious expression in the expectedValue field for advanced HTTP monitor matching. server/src/api/validation/monitorValidation.ts accepts the expression, and server/src/service/network/AdvancedMatcher.ts synchronously evaluates it against an attacker-controlled HTTP response body on the Node.js main event loop without a timeout or worker isolation, allowing catastrophic backtracking to freeze API endpoints, monitor checks, and WebSocket connections for all users. This issue is fixed in version 3.9.2.
CVE-2026-72818 is a high-severity vulnerability in the nltk library's TweetTokenizer component. It arises from an inefficient regular expression in nltk/tokenize/casual.py that can cause exponential backtracking when processing certain crafted inputs. This leads to excessive CPU consumption and potential denial of service by stalling services that tokenize untrusted social media text. Version 3.10.1 of nltk addresses this issue by bounding the label repetition in the regular expression.
CVE-2026-62317 is a high-severity vulnerability in logto-io's Logto authentication infrastructure prior to version 1.41.0. It involves inefficient regular expression complexity in the email subaddressing blocklist logic, which can cause catastrophic backtracking and stall the event loop. This denial-of-service condition affects authentication, token issuance, SSO, and the administrative console availability. The issue is fixed in version 1.41.0.
Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regex_replace filter and function in system/config/security.yaml, and GravExtension::regexReplace() passes an editor-controlled pattern directly to preg_replace(). When security.twig_content.process_enabled is enabled, an authenticated page editor can publish a catastrophically backtracking pattern that consumes PHP worker CPU and denies service to site visitors. This issue is fixed in version 2.0.4.
CVE-2026-59893 is a high-severity vulnerability in the Python sqlparse module prior to version 0.6.0. The issue involves inefficient regular expression complexity causing quadratic CPU consumption when parsing certain SQL constructs such as unmatched dollar-quoted literals and multiline comments. This can lead to denial of service through excessive CPU usage. The vulnerability is fixed in sqlparse version 0.6.0.
CVE-2026-54284 is a high-severity vulnerability in the Python sqlparse module prior to version 0.6.0. The issue arises from inefficient algorithmic complexity during TokenList construction and string conversion, causing quadratic CPU consumption when using sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This inefficiency is due to repeatedly flattening nested token subtrees. The vulnerability is fixed in sqlparse version 0.6.0.
CVE-2026-58436 is a high-severity vulnerability in Gitea Open Source Git Server affecting versions up to 1.26.4. It involves a quadratic-time denial-of-service (DoS) attack via the ParseAcceptLanguage function in the Locale middleware, which can be triggered by unauthenticated requests. This flaw does not impact confidentiality or integrity but can cause service disruption due to resource exhaustion.
CVE-2026-73556 is a denial-of-service vulnerability in the vllm project's lm-format-enforcer backend. The backend compiles attacker-supplied regular expressions without a timeout or buildability check, allowing a crafted regex to stall the engine worker by consuming excessive CPU. This issue affects versions of vllm prior to 0.26.0 when the lm-format-enforcer backend is explicitly enabled. The default backend is not affected. The vulnerability results in unauthenticated denial of service by hanging the structured-output compile step and blocking concurrent requests.
CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed #recipe= URL fragment containing a large number of unmatched quote characters reaches Utils.parseRecipeConfig(). The function synchronously applies a complex global regular expression that may perform heavy backtracking before rejecting the input, causing the victim's browser tab to freeze during startup for seconds or longer. No code execution, data exfiltration, or privilege escalation occurs. This issue is fixed in version 11.3.0.
A regular expression denial of service (ReDoS) vulnerability exists in the honojs hono web framework prior to version 4.12.34. The issue occurs in the built-in CORS middleware (hono/cors) when processing the Access-Control-Request-Headers header during a preflight OPTIONS request. The vulnerable regular expression can cause quadratic backtracking, leading to excessive CPU consumption and potential service unavailability. This affects default configurations where allowHeaders is unset or empty. The vulnerability is fixed in version 4.12.34.
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.
### Summary
Four inline processors in pymdown-extensions contain regular expressions with
exponential backtracking. A single untrusted Markdown line under
50 bytes drives `markdown.markdown()` into unbounded CPU on the rendering thread
(seconds at ~45 bytes, growing exponentially with each added character). All four
fire in the extension's **default configuration**
and are reachable through the documented public API. The `caret`/`tilde`/
`betterem` blow-up was introduced by the emphasis-pattern rewrite in PR #2547
(first released in **10.13**, Dec 2024) — earlier releases used a linear
`(.+?)` / `([^\s]+?)` content group — and is present through **11.0** (latest);
`magiclink`'s host pattern is long-standing and affects effectively all releases.
Likely **CWE-1333 (Inefficient Regular Expression Complexity)**.
This is a distinct issue from CVE-2025-68142 (ReDoS in `pymdownx.blocks.caption`,
`RE_FIG_NUM`, fixed in 10.16.1): different extensions, different regexes, and a
different root cause (delimiter-run partition ambiguity rather than a `.`/`\.`
typo).
### Details
Four regexes share, or closely mirror, a vulnerable shape — an inner group that
can partition a run of the delimiter character into `{2,}`-sized pieces in
exponentially many ways, wrapped in a lazy `+?` that must fail before the engine
can give up:
| Extension | Regex | Location (`11.0`) |
|---|---|---|
| `pymdownx.caret` (superscript `^…^`) | `SUP2` | `pymdownx/caret.py:56` |
| `pymdownx.tilde` (subscript `~…~`) | `SUB2` | `pymdownx/tilde.py:55` |
| `pymdownx.betterem` (underscore `_…_`) | `SMART_UNDER_EM2` (default) | `pymdownx/betterem.py:93` |
| `pymdownx.magiclink` (bare-URL autolink) | `RE_LINK` | `pymdownx/magiclink.py:56` (host at `:59`) |
`pymdownx/caret.py:56` (`pymdown-extensions 11.0`):
```python
SUP2 = r'(?<!\^)(\^)(?![\^\s])((?:[^\^\s]|\^{2,})+?)(?<![\^\s])(\^)(?!\^)'
```
The content group `(?:[^\^\s]|\^{2,})+?` matches a run of carets only via the
`\^{2,}` branch. A run of *k* carets can be split into ≥2-length pieces in
exponentially many combinations; when no caret can serve as a valid closing
delimiter (the trailing `(?<![\^\s])(\^)` cannot be satisfied), the engine
explores every partition before failing. `SUB2` (tilde) and `SMART_UNDER_EM2`
(betterem) are the same construct for `~` and `_`. In `betterem` the default
`smart_enable='underscore'` routes underscores to `SmartUnderscoreProcessor` →
`SMART_UNDER_EM2` (`betterem.py:93`), which is the default-reachable,
API-exploitable pattern; the non-smart `UNDER_EM2` (`:69`, used only when
`smart_enable` is `asterisk`/`disable`) shares the shape but did not reproduce
through the public `markdown.markdown()` pipeline on the tested payload, so a fix
and regression test should target `SMART_UNDER_EM2`.
`pymdownx/magiclink.py:59` has the analogous ambiguity in the host portion, where
overlapping character classes let a run of dots be grouped exponentially:
```python
(?:ht|f)tps?://[^_\W][-\w]*(?:\.[-\w.]+)* # host: '\.' and '[-\w.]' inside (?:...)* both match '.'
```
`SUP2`/`SUB2`/`SMART_UNDER_EM2` are applied at each delimiter occurrence via the
default `PatternSequenceProcessor` subclasses (`pymdownx/util.py`); `RE_LINK` is
applied by `MagiclinkPattern` (registered unconditionally at priority 85). In all
four cases, rendering `markdown.markdown(src, extensions=[ext])` on untrusted
`src` in default configuration is sufficient to reach the regex.
### PoC
Single self-contained script; runs against the pinned release in an ephemeral
env. Non-destructive — the input is ordinary Markdown text; the impact is CPU/time
(a per-render alarm caps each attempt so the script terminates).
```python
import signal
import time
from importlib.metadata import version
import markdown
print(f"# pymdown-extensions {version('pymdown-extensions')} / markdown {version('markdown')}")
CAP = 5.0 # a single render exceeding this is treated as a hang
class Timeout(Exception):
pass
def render(ext, text):
signal.signal(signal.SIGALRM, lambda *_: (_ for _ in ()).throw(Timeout()))
signal.setitimer(signal.ITIMER_REAL, CAP)
t = time.perf_counter()
try:
markdown.markdown(text, extensions=[ext])
return time.perf_counter() - t
except Timeout:
return None
finally:
signal.setitimer(signal.ITIMER_REAL, 0)
# ext -> (malicious builder, benign builder [valid & closed], ramp, hang count)
CASES = {
"pymdownx.caret": (lambda n: "^a" + "^" * n + "b", lambda n: "^" + "a" * n + "^", [24, 30, 36], 44),
"pymdownx.tilde": (lambda n: "~a" + "~" * n + "b", lambda n: "~" + "a" * n + "~", [24, 30, 36], 44),
"pymdownx.betterem": (lambda n: "_a" + "_" * n + "b", lambda n: "_" + "a" * n + "_", [24, 30, 36], 44),
"pymdownx.magiclink": (lambda n: "http://a" + "." * n + " ", lambda n: "http://" + "a" * n + ".com ", [28, 32, 36], 40),
}
repro = []
for ext, (evil, benign, ramp, hang) in CASES.
CVE-2026-68749 is a high-severity vulnerability in the rrrene html_sanitize_ex library that causes inefficient regular expression complexity in its CSS scrubber. An unauthenticated remote attacker can exploit this by sending a long CSS declaration that triggers excessive CPU usage during HTML sanitization, leading to denial of service. The vulnerability arises from a regex pattern that matches property names greedily without length limits, causing quadratic time complexity. This results in CPU exhaustion but does not lead to data disclosure or modification. The affected versions are from 0.3.1 up to but not including 1.5.3, including 1.5.0-rc.0. No patch information is provided in the source data.