Common Weakness Enumeration

CWE-1333

Allowed

Inefficient Regular Expression Complexity

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

963 vulnerabilities reference this CWE, most recent first.

CVE-2026-121577 (GCVE-0-2026-121577)

Vulnerability from cvelistv5 – Published: 2026-11-03 19:52 – Updated: 2026-11-03 19:52 X_Open Source
VLAI
Title
Unescaped header separators in whatstk build a regular expression that backtracks exponentially
Summary
Inefficient Regular Expression Complexity (CWE-1333) in generate_regex() (whatstk/whatsapp/parser.py) in whatstk from 0.2.0 before 0.9.0 allows a party that supplies a chat export to consume the CPU of the process that parses it for an unbounded time, because the function builds the header regular expression by replacing each %x code with its named capture group and leaves every other character of the header format in the pattern unescaped. A header whose date separator is a regular expression metacharacter therefore alters the pattern instead of matching itself: a separator of + quantifies the preceding capture group, giving (?P<day>\d{1,2})+(?P<month>\d{1,2})+(?P<year>\d{2,4}), and a run of digits that cannot complete the header then makes the engine try every way of partitioning that run. Header auto detection is enabled by default and derives the format from the text of the file, so the separator is taken from the export itself and no header format has to be passed by the caller. Separators of (, ) and \ instead raise re.PatternError, separators of *, | and ? raise TypeError, and separators of ^ and $ raise KeyError, none of which the library catches. This results in the parse of a file of a few hundred bytes consuming CPU without completing, or in an uncaught exception in the calling program.
Severity
6.7 (Medium)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
Secur0 CNA under the INCIBE root
CNA scorecard A 99/100 over 46 records in the last 180 days details
References
Impacted products
Vendor Product Version
lucasrodes whatstk Affected: 0.2.0 , < 0.9.0 (semver)
    cpe:2.3:a:lucasrodes:whatstk:*:*:*:*:*:python:*:*
Create a notification for this product.
Credits
m.gongora.carriedo Xoán M. Otero Jorge Darío Rivas Secur0 CNA Lucas Rodés-Guirao
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.org",
          "defaultStatus": "unaffected",
          "packageName": "whatstk",
          "product": "whatstk",
          "programFiles": [
            "whatstk/whatsapp/parser.py",
            "whatstk/whatsapp/auto_header.py"
          ],
          "repo": "https://github.com/lucasrodes/whatstk",
          "vendor": "lucasrodes",
          "versions": [
            {
              "lessThan": "0.9.0",
              "status": "affected",
              "version": "0.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:lucasrodes:whatstk:*:*:*:*:*:python:*:*",
                  "versionEndExcluding": "0.9.0",
                  "versionStartIncluding": "0.2.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "m.gongora.carriedo"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Xo\u00e1n M. Otero Jorge"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Dar\u00edo Rivas"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Secur0 CNA"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Lucas Rod\u00e9s-Guirao"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Inefficient Regular Expression Complexity (CWE-1333) in \u003ccode\u003egenerate_regex()\u003c/code\u003e (\u003ccode\u003ewhatstk/whatsapp/parser.py\u003c/code\u003e) in whatstk from 0.2.0 before 0.9.0 allows a party that supplies a chat export to consume the CPU of the process that parses it for an unbounded time, because the function builds the header regular expression by replacing each \u003ccode\u003e%x\u003c/code\u003e code with its named capture group and leaves every other character of the header format in the pattern unescaped. A header whose date separator is a regular expression metacharacter therefore alters the pattern instead of matching itself: a separator of \u003ccode\u003e+\u003c/code\u003e quantifies the preceding capture group, giving \u003ccode\u003e(?P\u0026lt;day\u0026gt;\\d{1,2})+(?P\u0026lt;month\u0026gt;\\d{1,2})+(?P\u0026lt;year\u0026gt;\\d{2,4})\u003c/code\u003e, and a run of digits that cannot complete the header then makes the engine try every way of partitioning that run. Header auto detection is enabled by default and derives the format from the text of the file, so the separator is taken from the export itself and no header format has to be passed by the caller. Separators of \u003ccode\u003e(\u003c/code\u003e, \u003ccode\u003e)\u003c/code\u003e and \u003ccode\u003e\\\u003c/code\u003e instead raise \u003ccode\u003ere.PatternError\u003c/code\u003e, separators of \u003ccode\u003e*\u003c/code\u003e, \u003ccode\u003e|\u003c/code\u003e and \u003ccode\u003e?\u003c/code\u003e raise \u003ccode\u003eTypeError\u003c/code\u003e, and separators of \u003ccode\u003e^\u003c/code\u003e and \u003ccode\u003e$\u003c/code\u003e raise \u003ccode\u003eKeyError\u003c/code\u003e, none of which the library catches. This results in the parse of a file of a few hundred bytes consuming CPU without completing, or in an uncaught exception in the calling program."
            }
          ],
          "value": "Inefficient Regular Expression Complexity (CWE-1333) in generate_regex() (whatstk/whatsapp/parser.py) in whatstk from 0.2.0 before 0.9.0 allows a party that supplies a chat export to consume the CPU of the process that parses it for an unbounded time, because the function builds the header regular expression by replacing each %x code with its named capture group and leaves every other character of the header format in the pattern unescaped. A header whose date separator is a regular expression metacharacter therefore alters the pattern instead of matching itself: a separator of + quantifies the preceding capture group, giving (?P\u003cday\u003e\\d{1,2})+(?P\u003cmonth\u003e\\d{1,2})+(?P\u003cyear\u003e\\d{2,4}), and a run of digits that cannot complete the header then makes the engine try every way of partitioning that run. Header auto detection is enabled by default and derives the format from the text of the file, so the separator is taken from the export itself and no header format has to be passed by the caller. Separators of (, ) and \\ instead raise re.PatternError, separators of *, | and ? raise TypeError, and separators of ^ and $ raise KeyError, none of which the library catches. This results in the parse of a file of a few hundred bytes consuming CPU without completing, or in an uncaught exception in the calling program."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333 Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T19:52:54.454Z",
        "orgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
        "shortName": "Secur0"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/lucasrodes/whatstk/pull/181"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/lucasrodes/whatstk/commit/01d66d8"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/lucasrodes/whatstk/releases/tag/v0.9.0"
        },
        {
          "tags": [
            "third-party-advisory",
            "technical-description"
          ],
          "url": "https://secur0.com/en/cna/cve-list/cve-2026-121577-whatstk-header-regex-redos"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade to whatstk 0.9.0 or later."
            }
          ],
          "value": "Upgrade to whatstk 0.9.0 or later."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "Unescaped header separators in whatstk build a regular expression that backtracks exponentially",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
    "assignerShortName": "Secur0",
    "cveId": "CVE-2026-121577",
    "datePublished": "2026-11-03T19:52:54.454Z",
    "dateReserved": "2026-11-03T15:29:19.749Z",
    "dateUpdated": "2026-11-03T19:52:54.454Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-120645 (GCVE-0-2026-120645)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:40 – Updated: 2026-11-03 23:40
VLAI
Title
CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list
Summary
CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list. When rendering option groups, scrolling_list marks the selected options by interpolating each selected value, by default taken from the request parameters, unescaped into a substitution pattern. A client can make the request die with an invalid pattern, or tie up the process with one that backtracks heavily.
Severity
No CVSS data available.
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
  • CWE-625 - Permissive Regular Expression
Assigner
CPANSec CNA under the redhat root
CNA scorecard C 62/100 over 370 records in the last 180 days details
References
Impacted products
Vendor Product Version
Affected: 0 , < 5.00 (custom)
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "CGI"
          ],
          "packageName": "CGI",
          "packageURL": "pkg:cpan/CGI",
          "programFiles": [
            "lib/CGI.pm"
          ],
          "programRoutines": [
            {
              "name": "CGI::scrolling_list"
            }
          ],
          "repo": "https://github.com/leejo/CGI.pm",
          "versions": [
            {
              "lessThan": "5.00",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list.\n\nWhen rendering option groups, scrolling_list marks the selected options by interpolating each selected value, by default taken from the request parameters, unescaped into a substitution pattern.\n\nA client can make the request die with an invalid pattern, or tie up the process with one that backtracks heavily."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333 Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-625",
              "description": "CWE-625 Permissive Regular Expression",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:40:54.754Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/LEEJO/CGI-5.00/changes"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/leejo/CGI.pm/commit/824956fbb0c4eb77044ba2dc9180a30df12cb309.patch"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to CGI 5.00 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-120645",
    "datePublished": "2026-11-03T23:40:54.754Z",
    "dateReserved": "2026-11-02T17:42:57.379Z",
    "dateUpdated": "2026-11-03T23:40:54.754Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-120632 (GCVE-0-2026-120632)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:40 – Updated: 2026-11-03 23:40
VLAI
Title
CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type
Summary
CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type. When a POST Content-Type contains multipart/related, the boundary and start parameters are extracted with an unanchored pattern that puts .+ on either side of the boundary capture, which backtracks in cubic time on a header that does not match. No request body is needed.
Severity
No CVSS data available.
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
CPANSec CNA under the redhat root
CNA scorecard C 62/100 over 370 records in the last 180 days details
References
Impacted products
Vendor Product Version
Affected: 0 , < 5.00 (custom)
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "CGI"
          ],
          "packageName": "CGI",
          "packageURL": "pkg:cpan/CGI",
          "programFiles": [
            "lib/CGI.pm"
          ],
          "programRoutines": [
            {
              "name": "CGI::init"
            }
          ],
          "repo": "https://github.com/leejo/CGI.pm",
          "versions": [
            {
              "lessThan": "5.00",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type.\n\nWhen a POST Content-Type contains multipart/related, the boundary and start parameters are extracted with an unanchored pattern that puts .+ on either side of the boundary capture, which backtracks in cubic time on a header that does not match. No request body is needed."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333 Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:40:01.071Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/LEEJO/CGI-5.00/changes"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/leejo/CGI.pm/commit/1e529c7ac8d410a51b4b04ab9d6cc00d51ef33c0.patch"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to CGI 5.00 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type",
      "workarounds": [
        {
          "lang": "en",
          "value": "For deployments that cannot upgrade, reject Content-Type request headers longer than 1KB at the web server."
        }
      ],
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-120632",
    "datePublished": "2026-11-03T23:40:01.071Z",
    "dateReserved": "2026-11-02T17:39:55.528Z",
    "dateUpdated": "2026-11-03T23:40:01.071Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-120631 (GCVE-0-2026-120631)

Vulnerability from cvelistv5 – Published: 2026-11-03 23:39 – Updated: 2026-11-03 23:39
VLAI
Title
CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse
Summary
CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse. CGI's cookie method reads the Cookie request header through parse, which interpolates the header's expires value unescaped into the substitution pattern that removes it from the cookie string. A client can make the request die with an invalid pattern, or tie up the process with one that backtracks catastrophically.
Severity
No CVSS data available.
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
  • CWE-625 - Permissive Regular Expression
Assigner
CPANSec CNA under the redhat root
CNA scorecard C 62/100 over 370 records in the last 180 days details
References
Impacted products
Vendor Product Version
Affected: 4.67 , < 5.00 (custom)
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "CGI::Cookie"
          ],
          "packageName": "CGI",
          "packageURL": "pkg:cpan/CGI",
          "programFiles": [
            "lib/CGI/Cookie.pm"
          ],
          "programRoutines": [
            {
              "name": "CGI::Cookie::parse"
            },
            {
              "name": "CGI::cookie"
            }
          ],
          "repo": "https://github.com/leejo/CGI.pm",
          "versions": [
            {
              "lessThan": "5.00",
              "status": "affected",
              "version": "4.67",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse.\n\nCGI\u0027s cookie method reads the Cookie request header through parse, which interpolates the header\u0027s expires value unescaped into the substitution pattern that removes it from the cookie string.\n\nA client can make the request die with an invalid pattern, or tie up the process with one that backtracks catastrophically."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333 Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-625",
              "description": "CWE-625 Permissive Regular Expression",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T23:39:55.189Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI/Cookie.pm"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/LEEJO/CGI-5.00/changes"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/leejo/CGI.pm/commit/95e044af2ec24d99a61e99d6291580ad47aff641.patch"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to CGI 5.00 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-120631",
    "datePublished": "2026-11-03T23:39:55.189Z",
    "dateReserved": "2026-11-02T17:36:13.881Z",
    "dateUpdated": "2026-11-03T23:39:55.189Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-120217 (GCVE-0-2026-120217)

Vulnerability from cvelistv5 – Published: 2026-11-01 06:15 – Updated: 2026-11-01 06:15
VLAI
Title
Delgan loguru ANSI Color-Markup _colorizer.py AnsiParser.feed redos
Summary
A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file loguru/_colorizer.py of the component ANSI Color-Markup Parser. Performing a manipulation results in inefficient regular expression complexity. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C
4.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
  • CWE-400 - Resource Consumption
Assigner
VulDB CNA under the mitre root
CNA scorecard B 83/100 over 3789 records in the last 180 days details
References
URL Tags
https://vuldb.com/vuln/429568 vdb-entrytechnical-description
https://vuldb.com/vuln/429568/cti signaturepermissions-required
https://vuldb.com/cve/CVE-2026-120217 third-party-advisory
https://vuldb.com/submit/992264 third-party-advisory
Impacted products
Vendor Product Version
Delgan loguru Affected: 0.7.3
    cpe:2.3:a:delgan:loguru:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
xianggudahundun (VulDB User) VulDB CNA Team
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:delgan:loguru:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "ANSI Color-Markup Parser"
          ],
          "product": "loguru",
          "vendor": "Delgan",
          "versions": [
            {
              "status": "affected",
              "version": "0.7.3"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "xianggudahundun (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file loguru/_colorizer.py of the component ANSI Color-Markup Parser. Performing a manipulation results in inefficient regular expression complexity. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-01T06:15:17.369Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-429568 | Delgan loguru ANSI Color-Markup _colorizer.py AnsiParser.feed redos",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/429568"
        },
        {
          "name": "VDB-429568 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/429568/cti"
        },
        {
          "name": "CVE-2026-120217 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-120217"
        },
        {
          "name": "Submit #992264 | Delgan loguru 0.7.3 Denial of Service",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/992264"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-31T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-31T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-31T17:35:05.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Delgan loguru ANSI Color-Markup _colorizer.py AnsiParser.feed redos",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-120217",
    "datePublished": "2026-11-01T06:15:17.369Z",
    "dateReserved": "2026-10-31T16:29:58.549Z",
    "dateUpdated": "2026-11-01T06:15:17.369Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-119300 (GCVE-0-2026-119300)

Vulnerability from cvelistv5 – Published: 2026-10-30 16:29 – Updated: 2026-10-30 16:29
VLAI
Title
Wekan: ReDoS via Unescaped User Input in RegExp
Summary
Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp() without escaping regular-expression metacharacters. MongoDB-backed deployments evaluate the resulting patterns with PCRE2, allowing a logged-in user to submit catastrophic-backtracking expressions that consume database CPU and degrade or deny service to other users; searchUsers additionally requires board membership or site-admin status. The FerretDB v1 / RE2 unaffected configuration is not practically affected by catastrophic backtracking. This issue is fixed in version 11.11.
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7913 records in the last 180 days details
References
Impacted products
Vendor Product Version
wekan wekan Affected: < 11.11
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "wekan",
          "vendor": "wekan",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 11.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp() without escaping regular-expression metacharacters. MongoDB-backed deployments evaluate the resulting patterns with PCRE2, allowing a logged-in user to submit catastrophic-backtracking expressions that consume database CPU and degrade or deny service to other users; searchUsers additionally requires board membership or site-admin status. The FerretDB v1 / RE2 unaffected configuration is not practically affected by catastrophic backtracking. This issue is fixed in version 11.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T16:29:16.786Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/wekan/wekan/security/advisories/GHSA-9846-cj96-6hv5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/wekan/wekan/security/advisories/GHSA-9846-cj96-6hv5"
        },
        {
          "name": "https://github.com/wekan/wekan/commit/4ce5cf6e102854d326e1dcacde6cd20614525dec",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/wekan/wekan/commit/4ce5cf6e102854d326e1dcacde6cd20614525dec"
        },
        {
          "name": "https://github.com/wekan/wekan/releases/tag/v11.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/wekan/wekan/releases/tag/v11.11"
        }
      ],
      "source": {
        "advisory": "GHSA-9846-cj96-6hv5",
        "discovery": "UNKNOWN"
      },
      "title": "Wekan: ReDoS via Unescaped User Input in RegExp"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119300",
    "datePublished": "2026-10-30T16:29:16.786Z",
    "dateReserved": "2026-10-29T18:50:28.066Z",
    "dateUpdated": "2026-10-30T16:29:16.786Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-119202 (GCVE-0-2026-119202)

Vulnerability from cvelistv5 – Published: 2026-10-29 20:24 – Updated: 2026-11-03 16:38
VLAI
Title
@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service
Summary
@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Disposition parameter contains a long token without an equals sign. The resulting quadratic processing can block the Node.js event loop before route handlers or validation when @hapi/pez parses multipart/form-data headers, including unauthenticated hapi routes with payload.multipart enabled, and also affects applications that pass untrusted headers directly to Content.disposition(). This issue is fixed in @hapi/content version 6.0.3.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 16:37 UTC
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7913 records in the last 180 days details
References
Impacted products
Vendor Product Version
hapijs content Affected: < 6.0.3
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119202",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T16:37:48.843191Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T16:38:51.796Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpv"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "content",
          "vendor": "hapijs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() uses an unanchored parameter-name expression in a global regular-expression scan, causing repeated failed matching over the remaining input when a Content-Disposition parameter contains a long token without an equals sign. The resulting quadratic processing can block the Node.js event loop before route handlers or validation when @hapi/pez parses multipart/form-data headers, including unauthenticated hapi routes with payload.multipart enabled, and also affects applications that pass untrusted headers directly to Content.disposition(). This issue is fixed in @hapi/content version 6.0.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T20:24:17.210Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/hapijs/content/security/advisories/GHSA-8494-f6mr-cjpv"
        },
        {
          "name": "https://github.com/hapijs/content/commit/0993851dc7234976a3fce3a7c31662b213c940fd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hapijs/content/commit/0993851dc7234976a3fce3a7c31662b213c940fd"
        },
        {
          "name": "https://github.com/hapijs/content/releases/tag/v6.0.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hapijs/content/releases/tag/v6.0.3"
        }
      ],
      "source": {
        "advisory": "GHSA-8494-f6mr-cjpv",
        "discovery": "UNKNOWN"
      },
      "title": "@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119202",
    "datePublished": "2026-10-29T20:24:17.210Z",
    "dateReserved": "2026-10-29T16:04:48.728Z",
    "dateUpdated": "2026-11-03T16:38:51.796Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118993 (GCVE-0-2026-118993)

Vulnerability from cvelistv5 – Published: 2026-10-30 13:11 – Updated: 2026-10-30 13:11
VLAI
Title
CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI
Summary
CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The before_dispatch hook installed by startup() removes PATH_INFO from the end of the request URI with a substitution that interpolates PATH_INFO unquoted. Under CGI, FastCGI and PSGI both values come from the request, so the client chooses both the pattern and the string it is matched against. A short unauthenticated request with a backreference in the path backtracks exponentially and can keep a worker process busy for minutes.
Severity
No CVSS data available.
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
CPANSec CNA under the redhat root
CNA scorecard C 62/100 over 370 records in the last 180 days details
References
Impacted products
Vendor Product Version
Affected: 0 , < 0.62.0 (custom)
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "CallBackery"
          ],
          "packageName": "CallBackery",
          "packageURL": "pkg:cpan/CallBackery",
          "programFiles": [
            "lib/CallBackery.pm"
          ],
          "programRoutines": [
            {
              "name": "CallBackery::startup"
            }
          ],
          "repo": "https://github.com/oetiker/callbackery",
          "versions": [
            {
              "lessThan": "0.62.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI.\n\nThe before_dispatch hook installed by startup() removes PATH_INFO from the end of the request URI with a substitution that interpolates PATH_INFO unquoted. Under CGI, FastCGI and PSGI both values come from the request, so the client chooses both the pattern and the string it is matched against.\n\nA short unauthenticated request with a backreference in the path backtracks exponentially and can keep a worker process busy for minutes."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333 Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T13:11:14.458Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to CallBackery 0.62.0 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-118993",
    "datePublished": "2026-10-30T13:11:14.458Z",
    "dateReserved": "2026-10-29T10:58:47.286Z",
    "dateUpdated": "2026-10-30T13:11:14.458Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118779 (GCVE-0-2026-118779)

Vulnerability from cvelistv5 – Published: 2026-10-29 18:45 – Updated: 2026-10-29 20:23
VLAI
Title
Forge: Regular expression denial of service in PEM decoding (pem.decode)
Summary
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(), including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service. This issue is fixed in version 1.4.1.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 20:22 UTC
CWE
  • CWE-400 - Uncontrolled Resource Consumption
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7913 records in the last 180 days details
References
Impacted products
Vendor Product Version
digitalbazaar forge Affected: < 1.4.1
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118779",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T20:22:46.362205Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T20:23:11.602Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "forge",
          "vendor": "digitalbazaar",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pem.decode(), lib/pem.js, missing END line to process the relevant input or security decision. node-forge used polynomial-time regular expressions in pem.decode(), including when searching for a matching END line and parsing encapsulated headers. An unauthenticated attacker able to supply PEM input to any high-level parser could consume excessive CPU with a long malformed message and cause denial of service. This issue is fixed in version 1.4.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T18:45:55.093Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-7wch-p9px-956x"
        },
        {
          "name": "https://github.com/digitalbazaar/forge/commit/412345db583cd28a9d23636d0d93e9f751b935f3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/digitalbazaar/forge/commit/412345db583cd28a9d23636d0d93e9f751b935f3"
        },
        {
          "name": "https://github.com/digitalbazaar/forge/releases/tag/v1.4.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"
        }
      ],
      "source": {
        "advisory": "GHSA-7wch-p9px-956x",
        "discovery": "UNKNOWN"
      },
      "title": "Forge: Regular expression denial of service in PEM decoding (pem.decode)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-118779",
    "datePublished": "2026-10-29T18:45:55.093Z",
    "dateReserved": "2026-10-28T19:20:05.018Z",
    "dateUpdated": "2026-10-29T20:23:11.602Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118772 (GCVE-0-2026-118772)

Vulnerability from cvelistv5 – Published: 2026-10-29 18:13 – Updated: 2026-11-04 01:33
VLAI
Title
joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service
Summary
joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no separator, causing quadratic work during String.prototype.split. The behavior applies to the default separator and every custom separator. Applications that validate attacker-controlled values with the multiple option and no effective prior length limit can have the Node.js event loop blocked for seconds by one request, preventing other work. A .max() rule is not sufficient when abortEarly: false allows the email rule to run after the maximum-length check fails. This vulnerability is fixed in versions 17.13.9 and 18.3.1.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 01:33 UTC
CWE
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7913 records in the last 180 days details
References
Impacted products
Vendor Product Version
hapijs joi Affected: >= 16.0.0, <= 17.1.1
Affected: >= 18.0.0, < 18.3.1
Create a notification for this product.
@hapi joi Affected: >= 16.0.0, <= 17.1.1
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118772",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T01:33:26.811594Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T01:33:51.841Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "joi",
          "vendor": "hapijs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 16.0.0, \u003c= 17.1.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 18.0.0, \u003c 18.3.1"
            }
          ]
        },
        {
          "product": "joi",
          "vendor": "@hapi",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 16.0.0, \u003c= 17.1.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no separator, causing quadratic work during String.prototype.split. The behavior applies to the default separator and every custom separator. Applications that validate attacker-controlled values with the multiple option and no effective prior length limit can have the Node.js event loop blocked for seconds by one request, preventing other work. A .max() rule is not sufficient when abortEarly: false allows the email rule to run after the maximum-length check fails. This vulnerability is fixed in versions 17.13.9 and 18.3.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T18:13:33.771Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg"
        },
        {
          "name": "https://github.com/hapijs/joi/pull/3162",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hapijs/joi/pull/3162"
        },
        {
          "name": "https://github.com/hapijs/joi/pull/3163",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hapijs/joi/pull/3163"
        },
        {
          "name": "https://github.com/hapijs/joi/commit/03dc1d909818503b06240dadc81e9227ed2649cf",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hapijs/joi/commit/03dc1d909818503b06240dadc81e9227ed2649cf"
        },
        {
          "name": "https://github.com/hapijs/joi/commit/807858d7480f5075b0610817e3e44230890fb18e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hapijs/joi/commit/807858d7480f5075b0610817e3e44230890fb18e"
        },
        {
          "name": "https://github.com/hapijs/joi/releases/tag/v17.13.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hapijs/joi/releases/tag/v17.13.9"
        },
        {
          "name": "https://github.com/hapijs/joi/releases/tag/v18.3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hapijs/joi/releases/tag/v18.3.1"
        }
      ],
      "source": {
        "advisory": "GHSA-4528-x5fx-h6hg",
        "discovery": "UNKNOWN"
      },
      "title": "joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-118772",
    "datePublished": "2026-10-29T18:13:33.771Z",
    "dateReserved": "2026-10-28T19:20:05.018Z",
    "dateUpdated": "2026-11-04T01:33:51.841Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation
Architecture and Design

Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.

Mitigation
System Configuration

Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.

Mitigation
Implementation

Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.

Mitigation
Implementation

Limit the length of the input that the regular expression will process.

CAPEC-492: Regular Expression Exponential Blowup

An adversary may execute an attack on a program that uses a poor Regular Expression(Regex) implementation by choosing input that results in an extreme situation for the Regex. A typical extreme situation operates at exponential time compared to the input size. This is due to most implementations using a Nondeterministic Finite Automaton(NFA) state machine to be built by the Regex algorithm since NFA allows backtracking and thus more complex regular expressions.

← Back to the CWE list