ring-clojure vulnerabilities and threats

CVE-2026-62864 is a vulnerability in the ring-clojure web application library prior to version 1.15.5. The issue lies in the wrap-nested-params middleware, which uses a backtracking regular expression to parse parameter names from URL query strings and HTTP request bodies. An attacker can craft malicious parameter names that cause quadratic time complexity in regex matching, leading to a denial of service. This affects applications using the middleware, including those using Ring-Defaults where nested-params is enabled by default. The vulnerability is fixed in version 1.15.5.