CWE-1333

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "jsonata"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "jsonata"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-52746"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-02T20:13:55Z",
    "nvd_published_at": "2026-07-17T19:17:16Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nBefore JSONata `2.2.0` and `1.8.9`, it is possible to craft non-matching inputs to the [$toMillis](https://docs.jsonata.org/date-time-functions#tomillis) function that cause superlinear backtracking in the ISO-8601 validation regex. This may lead to denial of service in applications that evaluate user-provided JSONata expressions.\n\n### Patches\nThis issue has been addressed in JSONata version 2.2.0 or later, and 1.8.9 or later on v1, via fixes that include https://github.com/jsonata-js/jsonata/pull/782 and https://github.com/jsonata-js/jsonata/pull/793. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation.\n\n### References\nhttps://github.com/jsonata-js/jsonata/releases/tag/v2.2.0\nhttps://github.com/jsonata-js/jsonata/releases/tag/v1.8.9\n\n### Credit\nThank you to Doruk Tan \u00d6zt\u00fcrk for disclosing this issue.",
  "id": "GHSA-86vw-mfpg-wwv9",
  "modified": "2026-08-03T20:49:57Z",
  "published": "2026-07-02T20:13:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jsonata-js/jsonata/security/advisories/GHSA-86vw-mfpg-wwv9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52746"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jsonata-js/jsonata/pull/782"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jsonata-js/jsonata/pull/793"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jsonata-js/jsonata/commit/80ba95d170f74e3f20f4f36b8b77d8c85cea7686"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jsonata-js/jsonata/commit/d6ffc17cb16a8e53c222205bd274624e919cce0b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jsonata-js/jsonata"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jsonata-js/jsonata/releases/tag/v1.8.9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "jsonata: Malicious inputs to \"$toMillis\" function can cause resource exhaustion"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "dparse"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-39280"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333",
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-27T15:28:00Z",
    "nvd_published_at": "2022-10-06T18:16:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\ndparse versions prior to 0.5.1 contain a regular expression that is vulnerable to [ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) (Regular Expression Denial of Service).\n\nAll users parsing index server URLs with dparse are impacted by this vulnerability.\n\n### Patches\nThe Patch is applied in the `0.5.2` version, all users are recommended to upgrade as soon as possible.\n\n### Workarounds\nAvoid passing index server URLs in the source file to be parsed.\n\n### References\n[https://github.com/pyupio/dparse/tree/security/remove-intensive-regex](https://github.com/pyupio/dparse/tree/security/remove-intensive-regex)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [support@pyup.io](mailto:support@pyup.io)\n",
  "id": "GHSA-8fg9-p83m-x5pq",
  "modified": "2024-11-18T16:26:27Z",
  "published": "2022-09-27T15:28:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pyupio/dparse/security/advisories/GHSA-8fg9-p83m-x5pq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39280"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pyupio/dparse/commit/8c990170bbd6c0cf212f1151e9025486556062d5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pyupio/dparse/commit/d87364f9db9ab916451b1b036cfeb039e726e614"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/dparse/PYSEC-2022-301.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pyupio/dparse"
    },
    {
      "type": "WEB",
      "url": "https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "ReDoS issue in dparse"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-3205"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333",
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-09-01T11:15:41Z",
    "severity": "MODERATE"
  },
  "details": "An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicious content.",
  "id": "GHSA-8gh5-v944-cphh",
  "modified": "2024-04-04T07:21:16Z",
  "published": "2023-09-01T12:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3205"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/2011464"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/415067"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.9.13"
      },
      "package": {
        "ecosystem": "npm",
        "name": "tf2-item-format"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.2.6"
            },
            {
              "fixed": "5.9.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-41655"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333",
      "CWE-624"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-07-23T14:10:45Z",
    "nvd_published_at": "2024-07-23T15:15:05Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nVersions of `tf2-item-format` since at least `4.2.6` are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when parsing crafted user input. \n\n## Tested Versions\n\n- `5.9.13`\n- `5.8.10`\n- `5.7.0`\n- `5.6.17`\n- `4.3.5`\n- `4.2.6`\n\n### v5\nUpgrade package to `^5.9.14`\n\n### v4\nNo patch exists. Please consult the [v4 to v5 migration guide](https://github.com/danocmx/node-tf2-item-format?tab=readme-ov-file#migrating-from-v4-to-v5) to upgrade to v5.\n\nIf upgrading to v5 is not possible, fork the module repository and implement the fix detailed below.\n\n## Impact\n\nThis vulnerability can be exploited by an attacker to perform DoS attacks on any service that uses any `tf2-item-format` to parse user input.",
  "id": "GHSA-8h55-q5qq-p685",
  "modified": "2024-07-23T15:51:54Z",
  "published": "2024-07-23T14:10:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/danocmx/node-tf2-item-format/security/advisories/GHSA-8h55-q5qq-p685"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41655"
    },
    {
      "type": "WEB",
      "url": "https://github.com/danocmx/node-tf2-item-format/commit/5cffcc16a9261d6a937bda72bfe6830e02e31eec"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/danocmx/node-tf2-item-format"
    },
    {
      "type": "WEB",
      "url": "https://github.com/danocmx/node-tf2-item-format/releases/tag/v5.9.14"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "(ReDoS) Regular Expression Denial of Service in tf2-item-format"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-13896"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-10T07:15:41Z",
    "severity": "MODERATE"
  },
  "details": "The WP-GeSHi-Highlight \u2014 rock-solid syntax highlighting for 259 languages WordPress plugin through 1.4.3 processes user-supplied input as a regular expression via the wp_geshi_filter_replace_code() function, which could lead to Regular Expression Denial of Service (ReDoS) issue",
  "id": "GHSA-8h58-9hjg-3xqh",
  "modified": "2025-05-15T21:31:25Z",
  "published": "2025-04-10T09:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13896"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/b8b622ea-e090-45ad-8755-b050fc055231"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "hono"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.12.34"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-69207"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-03T20:23:30Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe built-in CORS middleware (`hono/cors`) parses the attacker-controlled `Access-Control-Request-Headers` request header during a preflight (`OPTIONS`) request using a regular expression whose running time is quadratic in the input length. A single request carrying a long run of whitespace can consume seconds of CPU, and repeated requests can render the service unresponsive. This parsing runs under the default configuration.\n\n### Details\n\nOn a CORS preflight, when `allowHeaders` is not configured - the default - the middleware reflects and parses the `Access-Control-Request-Headers` value. The parser used a whitespace-tolerant regular expression whose backtracking makes the work grow quadratically (O(n\u00b2)) with the length of the value when it contains a long whitespace sequence without a delimiter.\n\nBecause the header value is bounded only by the deployment\u0027s maximum HTTP header size, a single preflight can block request processing for a noticeable amount of time; on runtimes that share one execution thread across requests, this stalls concurrent requests as well. No authentication, special origin, or user interaction is required.\n\nThis issue arises for any application using `cors()` with the default (or an empty) `allowHeaders`. Applications that set a non-empty `allowHeaders` do not reach the affected path.\n\n### Impact\n\nAn unauthenticated attacker can send preflight requests that each consume disproportionate CPU relative to their size, degrading or denying service. This is a denial-of-service issue only; it does not expose or modify data.",
  "id": "GHSA-8j4g-w8fx-2239",
  "modified": "2026-08-03T20:23:31Z",
  "published": "2026-08-03T20:23:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/honojs/hono/security/advisories/GHSA-8j4g-w8fx-2239"
    },
    {
      "type": "WEB",
      "url": "https://github.com/honojs/hono/commit/93fc250d8b4df58ea542cb945171de8013d5e6d5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/honojs/hono"
    },
    {
      "type": "WEB",
      "url": "https://github.com/honojs/hono/releases/tag/v4.12.34"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Hono: ReDoS in CORS middleware via Access-Control-Request-Headers"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.2.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "mistune"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0a1"
            },
            {
              "fixed": "3.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33079"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-06T16:52:43Z",
    "nvd_published_at": "2026-05-06T18:16:03Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nA ReDoS (Regular Expression Denial of Service) vulnerability in `LINK_TITLE_RE` allows an attacker who can supply Markdown for parsing to cause denial of service. A crafted 58-byte Markdown document blocks the parser for approximately 6 seconds (measured on Apple M2, Python 3.14.3), with exponential growth per additional byte pair.\n\n### Details\n\nThe vulnerable regex is defined in [`src/mistune/helpers.py#L20-L25`](https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L20-L25):\n\n```python\nLINK_TITLE_RE = re.compile(\n    r\"[ \\t\\n]+(\"\n    r\u0027\"(?:\\\\\u0027 + PUNCTUATION + r\u0027|[^\"\\x00])*\"|\u0027  # \"title\"\n    r\"\u0027(?:\\\\\" + PUNCTUATION + r\"|[^\u0027\\x00])*\u0027\"   # \u0027title\u0027\n    r\")\"\n)\n```\n\nThe double-quote branch compiles to `\"(?:\\\\[PUNCTUATION]|[^\"\\x00])*\"`. The two alternatives inside `(A|B)*` overlap: a backslash followed by a punctuation character (e.g. `\\!`) can be matched by **either** branch \u2014 as a 2-character escaped-punctuation sequence `\\\\!`, or as two individual `[^\"\\x00]` characters (`\\` then `!`). The same ambiguity exists in the single-quoted title branch.\n\nWhen the input contains repeated `\\!` pairs with no closing `\"`, the regex engine exhaustively backtracks through all 2^N combinations, resulting in **exponential O(2^N) time complexity**.\n\nThis is reachable through normal Markdown parsing via two code paths:\n1. **Inline links**: `[text](url \"PAYLOAD)` \u2192 [`parse_link()`](https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L178) \u2192 [`parse_link_title()`](https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L169)\n2. **Block link reference definitions**: `[label]: url \"PAYLOAD` \u2192 [`BlockParser.parse_ref_link()`](https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/block_parser.py#L220) \u2192 [`parse_link_title()`](https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L169) at [block_parser.py#L259](https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/block_parser.py#L259)\n\n### PoC\n\n```python\nimport mistune\nimport time\n\nmd = mistune.create_markdown()\n\n# Test with increasing N (number of \\! pairs)\nfor n in [15, 18, 20, 22, 25]:\n    payload = \u0027[x](y \"\u0027 + \u0027\\\\!\u0027 * n + \u0027)\u0027\n    start = time.time()\n    md(payload)\n    elapsed = time.time() - start\n    print(f\"N={n:2d}  len={len(payload):3d} bytes  time={elapsed:.3f}s\")\n```\n\nOutput (Apple M2, Python 3.14.3, mistune 3.2.0):\n\n```\nN=15  len= 38 bytes  time=0.007s\nN=18  len= 44 bytes  time=0.044s\nN=20  len= 48 bytes  time=0.178s\nN=22  len= 52 bytes  time=0.740s\nN=25  len= 58 bytes  time=5.922s\n```\n\nEach increment of N roughly doubles the execution time (consistent with O(2^N)).\n\nThe same attack works via block link reference definitions:\n\n```python\npayload = \u0027[l]: u \"\u0027 + \u0027\\\\!\u0027 * 25  # 58 bytes, ~6 seconds\nmd(payload)\n```\n\n### Impact\n\nThis is a denial of service vulnerability. Any application or service that parses user-supplied Markdown using mistune can be made unresponsive by an attacker submitting a small crafted input (under 100 bytes).\n\nAffected use cases include:\n- Web applications with Markdown-enabled input fields (comments, posts, descriptions)\n- Documentation systems that accept user contributions\n- API endpoints that process Markdown\n- Jupyter tooling such as nbconvert that relies on mistune for rendering\n\n### Suggested Fix\n\nExclude the backslash character from the catch-all character class to eliminate the alternation overlap:\n\n```python\n# Before (vulnerable):\nr\u0027\"(?:\\\\\u0027 + PUNCTUATION + r\u0027|[^\"\\x00])*\"\u0027\nr\"\u0027(?:\\\\\" + PUNCTUATION + r\"|[^\u0027\\x00])*\u0027\"\n\n# After (fixed):\nr\u0027\"(?:\\\\\u0027 + PUNCTUATION + r\u0027|[^\"\\\\\\x00])*\"\u0027\nr\"\u0027(?:\\\\\" + PUNCTUATION + r\"|[^\u0027\\\\\\x00])*\u0027\"\n```\n\nThis ensures a backslash can only be consumed by the escaped-punctuation branch, eliminating the ambiguity in both the double-quote and single-quote branches. Verified on mistune 3.2.0 (Apple M2, Python 3.14.3):\n- Reduces N=25 from 4.2 seconds to 0.000006 seconds (700,000x improvement)\n- Handles N=50 in 0.000008 seconds\n- Passes all existing functional tests (quoted titles, escaped quotes, escaped punctuation)",
  "id": "GHSA-8mp2-v27r-99xp",
  "modified": "2026-05-06T19:35:51Z",
  "published": "2026-05-06T16:52:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/security/advisories/GHSA-8mp2-v27r-99xp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33079"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/lepture/mistune"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L20-L25"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.10.2"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "nltk"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.10.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-81725"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333",
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-08T20:28:46Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\n`Pl196xCorpusReader` still parses whole TEI blocks with multiple lazy regexes over attacker-controlled text. A malformed file with many opening tags and no matching closing tags forces repeated rescans and produces quadratic CPU growth in public reader APIs.\n\n### Details\n\n- **Vulnerability type:** Regular-expression denial of service\n- **Affected component:** `nltk.corpus.reader.pl196x.TEICorpusView.read_block` and `Pl196xCorpusReader` public methods\n- **Affected versions:** Published `3.9.4` and current source `v3.10.0-rc2` both reproduced.\n- **Patched versions:** Not yet patched\n- **Root cause:** Lazy `.*?` whole-block regexes rescan untrusted XML-like blocks from each opening-tag position.\n\nThe parser uses regexes for paragraphs, sentences, and word tags across the whole `\u003ctext\u003e` block. When the attacker supplies many unmatched opening tags, each attempt scans toward the end of the block and fails, then restarts from the next opening tag. There is near four-times runtime growth each time the number of malformed `\u003cp\u003e` tags doubled, through normal public calls such as `words()` and `tagged_words()`.\n\n### PoC\n\n**Preconditions**\n- The application parses attacker-influenced PL196X or TEI-like corpus files through public reader APIs.\n\n**Steps**\n1. Create a corpus file with a valid header followed by a `\u003ctext\u003e` block that contains many opening tags and no matching closing tags.\n2. Instantiate `Pl196xCorpusReader` on that corpus.\n3. Call `words()` or `tagged_words()` and measure elapsed time as the malformed tag count doubles.\n4. Observe near quadratic growth instead of near-linear behavior.\n\n**Minimal reproducible excerpt**\n\n```text\nsize=1000 0.014s\nsize=2000 0.057s\nsize=4000 0.231s\nsize=8000 0.927s\n```\n\n### Impact\n\nA consumer that accepts attacker-influenced corpus files can be forced into heavy CPU use and parser-thread stalling before the application concludes the input contains no valid content.\n\n### Remediation\n\nReplace the whole-block lazy-regex parser with a linear parser or bounded tokenizer, and add regression tests that assert near-linear behavior on malformed inputs with many unmatched tags.",
  "id": "GHSA-8mpw-7fpc-4gqj",
  "modified": "2026-09-08T20:28:46Z",
  "published": "2026-09-08T20:28:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nltk/nltk/security/advisories/GHSA-8mpw-7fpc-4gqj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81725"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nltk/nltk/commit/7808692d451b962711005d954859bb83aabcf8fa"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nltk/nltk"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nltk/nltk/releases/tag/v3.10.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3752.yaml"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/nltk-before-3.10.3-regular-expression-denial-of-service-via-pl196xcorpusreader"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-3909"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333",
      "CWE-400"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-11-06T13:15:09Z",
    "severity": "MODERATE"
  },
  "details": "An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in timeout input in gitlab-ci.yml file.",
  "id": "GHSA-8mrc-cw5j-72jw",
  "modified": "2023-11-06T15:30:32Z",
  "published": "2023-11-06T15:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3909"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/2050269"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/418763"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.7.1"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "com.powsybl:powsybl-iidm-criteria"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.3.0"
            },
            {
              "fixed": "6.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.powsybl:powsybl-contingency-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "6.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-48059"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-19T16:19:48Z",
    "nvd_published_at": "2025-06-20T17:15:40Z",
    "severity": "LOW"
  },
  "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nThis is an advisory for a **potential polynomial Regular Expression Denial of Service (ReDoS)** vulnerability in the `RegexCriterion` class. This class compiles and evaluates an unvalidated, user-supplied regular expression against the identifier of an `Identifiable` object via `Pattern.compile(regex).matcher(id).find()`.\n\nTo trigger **polynomial ReDoS** in `RegexCriterion`, **two attacker-controlled conditions** must be met:\n- **Control over the regex input** passed into the constructor:\n  - _Example:_ An attacker supplies a malicious pattern such as `(.*a){10000}`.\n- **Control or influence over the output of `Identifiable.getId()`**:\n  -  _Example:_ A long string like `\"aaaa...!\"` that forces excessive backtracking.\n\nIf both conditions are satisfied, a malicious actor can cause **significant CPU exhaustion** through repeated or recursive `filter(...)` calls \u2014 especially if performed over large network models or filtering operations.\nWhile this class does not handle file or memory data directly, its reliance on untrusted regular expressions and potentially attacker-controlled identifiers makes it vulnerable to **polynomial ReDoS** under the right conditions. This risk is amplified when the library is used in dynamic or scriptable environments where external users control either criterion construction or network object identifiers.\nAlthough not as dangerous as _catastrophic exponential ReDoS_, the polynomial pattern still induces significant performance\ndegradation as input size increases.\n\n#### Am I impacted?\nSince `RegexCriterion` are used to define contingencies or limit reductions, you are vulnerable if:\n- you allow untrusted users to define contingency lists or limit reductions using this criterion;\n- OR you load untrusted contingencies or limit reductions files\n\nAND use them with a network containing untrusted identifiers.\n\n### Patches\ncom.powsybl:powsybl-iidm-criteria:6.7.2 and higher\n\n### References\n[powsybl-core v6.7.2](https://github.com/powsybl/powsybl-core/releases/tag/v6.7.2)",
  "id": "GHSA-8qjw-9xgm-c9ff",
  "modified": "2025-06-20T22:20:47Z",
  "published": "2025-06-19T16:19:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/powsybl/powsybl-core/security/advisories/GHSA-8qjw-9xgm-c9ff"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48059"
    },
    {
      "type": "WEB",
      "url": "https://github.com/powsybl/powsybl-core/commit/d8398f689a5ccd505bd62eee2bd6670a29133110"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/powsybl/powsybl-core"
    },
    {
      "type": "WEB",
      "url": "https://github.com/powsybl/powsybl-core/releases/tag/v6.7.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "PowSyBl Core Contains a Polynomial ReDoS in RegexCriterion"
}