IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.
CVE-2026-123792 is an inefficient algorithmic complexity vulnerability in the Symfony Yaml component affecting versions prior to 5.4.56, 6.4.50, 7.4.23, and 8.1.11. The vulnerability causes the YAML parser to perform excessive repeated work when processing certain crafted YAML documents, leading to exponential or quadratic parsing time growth. This can keep a PHP process busy for extended periods, potentially causing denial of service. The issue affects any code parsing untrusted YAML with default flags, including some Symfony request payload mappings that accept YAML input without restrictions. The vulnerability is rated high severity with a CVSS 4.0 score of 8.7.
CGI versions prior to 5.00 for Perl contain a vulnerability in the scrolling_list feature where submitted values are used unescaped in regular expressions for option group selection. This can lead to denial of service by causing the process to crash with invalid patterns or become unresponsive due to excessive regex backtracking.
A vulnerability in CGI versions before 5.00 for Perl allows CPU exhaustion through inefficient regular expression processing. The flaw arises when handling POST requests with a multipart/related Content-Type, where an unanchored regex pattern causes excessive backtracking on malformed headers. This can lead to denial of service without requiring a request body.
A denial of service vulnerability exists in CGI::Cookie versions from 4.67 up to but not including 5.00 for Perl. The issue arises because the expires value from a client cookie is used unescaped in a regular expression within the parse method, allowing crafted input to cause catastrophic backtracking or invalid regex patterns that crash the process. This flaw was fixed in version 5.00.
Inefficient Regular Expression Complexity (CWE-1333) in generate_regex() (whatstk/whatsapp/parser.py) in whatstk from 0.2.0 before 0.9.0 allows a party that supplies a chat export to consume the CPU of the process that parses it for an unbounded time, because the function builds the header regular expression by replacing each %x code with its named capture group and leaves every other character of the header format in the pattern unescaped. A header whose date separator is a regular expression metacharacter therefore alters the pattern instead of matching itself: a separator of + quantifies the preceding capture group, giving (?P<day>\d{1,2})+(?P<month>\d{1,2})+(?P<year>\d{2,4}), and a run of digits that cannot complete the header then makes the engine try every way of partitioning that run. Header auto detection is enabled by default and derives the format from the text of the file, so the separator is taken from the export itself and no header format has to be passed by the caller. Separators of (, ) and \ instead raise re.PatternError, separators of *, | and ? raise TypeError, and separators of ^ and $ raise KeyError, none of which the library catches. This results in the parse of a file of a few hundred bytes consuming CPU without completing, or in an uncaught exception in the calling program.
CVE-2026-62864 is a vulnerability in the ring-clojure web application library where the wrap-nested-params middleware uses a backtracking regular expression that can be exploited to cause a denial of service. This issue affects versions prior to 1.15.5 and is fixed in 1.15.5. Applications using ring-defaults are also exposed because nested-params is enabled by default. The vulnerability allows an attacker to craft parameter names that cause quadratic time complexity in regex matching, leading to resource exhaustion.
Wekan versions prior to 11.11 contain a vulnerability in the user search functionality where user-controlled input is passed directly to regular expression constructors without escaping metacharacters. This allows authenticated users with board membership or site-admin status to craft expressions that cause catastrophic backtracking in MongoDB-backed deployments, leading to high CPU consumption and potential denial of service. The issue is fixed in version 11.11.
CallBackery versions before 0.62.0 for Perl contain a denial of service vulnerability due to inefficient regular expression complexity. The flaw is caused by unquoted interpolation of the request path in a regular expression within the before_dispatch hook, which processes PATH_INFO from client requests. An unauthenticated attacker can exploit this by sending a crafted request with a backreference in the path, triggering exponential backtracking and tying up server worker processes.
Starlet versions from 0.20 up to but not including 0.33 contain an inefficient regular expression in chunked request body decoding. This flaw can cause CPU exhaustion due to regex backtracking when parsing chunk-size lines, allowing a remote attacker to cause high CPU usage with a specially crafted request. The issue is fixed in version 0.33.
@hapi/content versions from 3.0.6 up to but not including 6.0.3 contain a vulnerability in the Content.disposition() function where an unanchored regular expression causes inefficient processing. This can lead to quadratic time complexity when parsing certain Content-Disposition headers with long tokens lacking an equals sign, potentially blocking the Node.js event loop. The issue is fixed in version 6.0.3.
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(), including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service. This issue is fixed in version 1.4.1.
A vulnerability in the hapijs joi library versions from 16.0.0 up to 17.1.1 and from 18.0.0 up to but not including 18.3.1 allows inefficient regular expression processing in the Joi.string().email({ multiple: true }) validation rule. This causes quadratic time complexity during string splitting on long whitespace runs without separators, potentially blocking the Node.js event loop for seconds when processing attacker-controlled input. The issue is fixed in version 18.3.1.
A vulnerability in opentelemetry-java prior to version 1.67.0 allows an unauthenticated attacker to cause excessive CPU consumption by exploiting inefficient regular expression processing in the W3CTraceContextPropagator.extract() method. This occurs when parsing tracestate headers with long runs of spaces or tabs without a following comma, leading to quadratic backtracking. The issue is fixed in version 1.67.0.
CVE-2026-116268 is a vulnerability in MIME::Field::ParamVal versions before 5.521 for Perl that allows CPU exhaustion due to inefficient regular expression handling of unclosed comments in MIME header parameters. The parsing algorithm scans from each opening parenthesis '(' to the next closing parenthesis ')', but if a closing parenthesis is missing, the scan extends to the end of the header, causing quadratic time complexity. This inefficiency is compounded by repeated parsing on each attribute lookup, leading to significant CPU usage. For example, parsing a 40 KB header can take approximately 7 seconds once.
HTTP::Body versions before 1.24_01 for Perl contain a vulnerability due to inefficient regular expression complexity in parsing multipart upload filenames. An attacker can craft a filename with many dots ending in a backslash to cause excessive regex backtracking, resulting in CPU exhaustion. This can be triggered remotely with a single request, causing denial of service by high CPU usage.
HTTP::Body versions before 1.23_01 for Perl contain an inefficient regular expression in chunked request body parsing that can cause CPU exhaustion. The vulnerability arises from quadratic backtracking in regex matching of chunk-size lines without a carriage return before a line feed. This allows a remote attacker to cause high CPU usage by sending specially crafted chunked HTTP requests.
CVE-2026-116795 is a vulnerability in the le0pard re2js JavaScript regular expression engine versions 2.2.0 through 2.8.6. When LOOKBEHINDS are enabled and repeated matching functions like matcher().find(), matchAll(), split(), or matcher().replaceAll() are used, the engine can perform quadratic work due to inefficient algorithmic complexity. This causes excessive rescanning of input, potentially allowing attacker-controlled input to monopolize a single-threaded worker and cause denial of service. The issue is fixed in version 2.8.7.
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, unchecked loop condition and inefficient regular expression vulnerabilities in RadSpreadProcessing and RadSpreadStreamProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted XLSX or XLS workbook or formula.
A vulnerability in DataDog's dd-trace-js (Node.js APM client) allows crafted URL query strings to cause excessive CPU consumption due to inefficient regular expression processing. This can stall request handling and make the instrumented application unavailable. The issue affects versions from 2.0.0 up to but not including 5.131.1 and from 6.0.0 up to but not including 6.20.1. Fixed versions are 5.131.1 and 6.20.1.