Skip to content
Threat Feed
Subscribe

Tag

Redos

5 briefs RSS
low advisory

EspoCRM: Denial of service via ReDoS (CVE-2026-118686)

EspoCRM versions before 9.3.11 and 10.x before 10.0.8 are vulnerable to a denial of service attack where an unauthenticated attacker can exhaust server resources by submitting large API requests that trigger a vulnerable password-redaction regex.

EspoCRM +1 denial-of-service web-application redos cve-2026-118686
1t 1c
low advisory

ReDoS Vulnerability in NLTK TokenSearcher and Text findall Methods

The NLTK library is vulnerable to Regular Expression Denial of Service (ReDoS) due to unvalidated user-supplied regular expressions being processed without timeouts, allowing CPU exhaustion.

nltk denial-of-service redos application-vulnerability
1t 1c
low advisory

Linkify-it Denial of Service via Mailto Validator Quadratic Complexity

The JavaScript library linkify-it is vulnerable to a quadratic-complexity Denial of Service (DoS) (CVE-2026-59887) due to an inefficient regular expression in its `mailto:` schema validator, which allows an unauthenticated attacker to block application event loops by supplying specially crafted input with repeated 'mailto:' strings.

linkify-it <= 5.0.1 +1 denial-of-service nodejs web-application vulnerability redos
1t 1c
high advisory

Picomatch ReDoS Vulnerability via Extglob Quantifiers

Picomatch is vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns with quantifiers, leading to excessive CPU consumption and denial of service.

picomatch ReDoS denial-of-service extglob
2r 1t 1c
high advisory

Picomatch ReDoS Vulnerability via Extglob Quantifiers

Picomatch is vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns with quantifiers, leading to excessive CPU consumption and denial of service.

picomatch ReDoS denial-of-service extglob
2r 1t 1c