Common Weakness Enumeration

CWE-624

Weakness Allowed

Executable Regular Expression Error

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.

Case (2) is possible in the PHP preg_replace() function, and possibly in other languages when a user-controlled input is inserted into a string that is later parsed as a regular expression.

Mapping guidance

This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Relationships and members
ChildOf: CWE-77 · View CWE-1000
ChildOf: CWE-77 · View CWE-1305
ChildOf: CWE-77 · View CWE-1340
Modes of introduction
Implementation
Detection methods

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Notes

Research Gap

Under-studied. The existing PHP reports are limited to highly skilled researchers, but there are few examples for other languages. It is suspected that this is under-reported for all languages. Usability factors might make it more prevalent in PHP, but this theory has not been investigated.

Content history
Submission: CWE Content Team · MITRE · 2007-05-07 · CWE Draft 6
Modification: Eric Dalci · Cigital · 2008-07-01 · CWE 1.0

updated Time_of_Introduction

Modification: CWE Content Team · MITRE · 2008-09-08 · CWE 1.0

updated Applicable_Platforms, Relationships, Observed_Example

Modification: CWE Content Team · MITRE · 2008-10-14 · CWE 1.0.1

updated Description

Modification: CWE Content Team · MITRE · 2011-06-01 · CWE 1.13

updated Common_Consequences

Modification: CWE Content Team · MITRE · 2012-05-11 · CWE 2.2

updated Relationships

Modification: CWE Content Team · MITRE · 2012-10-30 · CWE 2.3

updated Potential_Mitigations

Modification: CWE Content Team · MITRE · 2014-06-23 · CWE 2.7

updated Observed_Examples

Modification: CWE Content Team · MITRE · 2014-07-30 · CWE 2.8

updated Relationships, Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2017-11-08 · CWE 3.0

updated Observed_Examples

Modification: CWE Content Team · MITRE · 2020-02-24 · CWE 4.0

updated Relationships

Modification: CWE Content Team · MITRE · 2020-08-20 · CWE 4.2

updated Relationships

Modification: CWE Content Team · MITRE · 2020-12-10 · CWE 4.3

updated Relationships

Modification: CWE Content Team · MITRE · 2023-04-27 · CWE 4.11

updated Relationships

Modification: CWE Content Team · MITRE · 2023-06-29 · CWE 4.12

updated Mapping_Notes

Modification: CWE Content Team · MITRE · 2025-12-11 · CWE 4.19

updated Detection_Factors, Weakness_Ordinalities

7 vulnerabilities reference this CWE, most recent first.

CVE-2026-113877 (GCVE-0-2026-113877)

Vulnerability from cvelistv5 – Published: 2026-10-23 20:07 – Updated: 2026-11-02 15:59
VLAI
Title
HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions
Summary
HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. _language_match interpolates each Accept-Language range into the pattern `/^$range\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range such as `(` fails to compile. A remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 15:59 UTC
CWE
  • CWE-624 - Executable Regular Expression Error
Assigner
CPANSec CNA under the redhat root
CNA scorecard C 62/100 over 369 records in the last 180 days details
References
Impacted products
Vendor Product Version
Affected: 0 , < 0.10 (custom)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-23T23:06:45.441Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/23/27"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-113877",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T15:59:32.790611Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T15:59:52.574Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "HTTP::Headers::ActionPack"
          ],
          "packageName": "HTTP-Headers-ActionPack",
          "packageURL": "pkg:cpan/HTTP-Headers-ActionPack",
          "programFiles": [
            "lib/HTTP/Headers/ActionPack/ContentNegotiation.pm"
          ],
          "programRoutines": [
            {
              "name": "HTTP::Headers::ActionPack::ContentNegotiation::_language_match"
            },
            {
              "name": "HTTP::Headers::ActionPack::ContentNegotiation::choose_language"
            }
          ],
          "repo": "https://github.com/robrwo/perl-HTTP-Headers-ActionPack/",
          "versions": [
            {
              "lessThan": "0.10",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions.\n\n_language_match interpolates each Accept-Language range into the pattern `/^$range\\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range such as `(` fails to compile.\n\nA remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-624",
              "description": "CWE-624 Executable Regular Expression Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T20:07:20.677Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/RRWO/HTTP-Headers-ActionPack-0.10/changes"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/robrwo/perl-HTTP-Headers-ActionPack/commit/77f0deb23f3de872c2e64befd72750e0f0f4bec9.patch"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to HTTP-Headers-ActionPack 0.10 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-113877",
    "datePublished": "2026-10-23T20:07:20.677Z",
    "dateReserved": "2026-10-20T20:16:52.798Z",
    "dateUpdated": "2026-11-02T15:59:52.574Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-97076 (GCVE-0-2026-97076)

Vulnerability from cvelistv5 – Published: 2026-10-09 07:00 – Updated: 2026-10-11 12:13 X_Open Source
VLAI
Title
WordPress WP Rocket plugin < 3.23.5 - Denial of Service Attack vulnerability
Summary
Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-11 12:01 UTC
CWE
  • CWE-624 - Executable Regular Expression Error
Assigner
Patchstack CNA under the mitre root
CNA scorecard B 75/100 over 3313 records in the last 180 days details
References
Impacted products
Vendor Product Version
WP Media WP Rocket Affected: 0 , < 3.23.5 (custom)
Create a notification for this product.
Date Public
2026-10-07 06:58
Credits
sahinyes | Patchstack Bug Bounty Program
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-97076",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-11T12:01:13.458673Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-11T12:13:42.465Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "wp-rocket",
          "product": "WP Rocket",
          "vendor": "WP Media",
          "versions": [
            {
              "changes": [
                {
                  "at": "3.23.5",
                  "status": "unaffected"
                }
              ],
              "lessThan": "3.23.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "sahinyes | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-07T06:58:13.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.\u003cp\u003eThis issue affects WP Rocket: from n/a before 3.23.5.\u003c/p\u003e"
            }
          ],
          "value": "Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-242",
          "descriptions": [
            {
              "lang": "en",
              "value": "Code Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-624",
              "description": "Executable Regular Expression Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T07:00:48.876Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/wp-rocket/vulnerability/wordpress-wp-rocket-plugin-3-23-5-denial-of-service-attack-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress WP Rocket plugin to the latest available version (at least 3.23.5)."
            }
          ],
          "value": "Update the WordPress WP Rocket plugin to the latest available version (at least 3.23.5)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress WP Rocket plugin \u003c 3.23.5 - Denial of Service Attack vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-97076",
    "datePublished": "2026-10-09T07:00:48.876Z",
    "dateReserved": "2026-09-24T00:20:10.982Z",
    "dateUpdated": "2026-10-11T12:13:42.465Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-25237 (GCVE-0-2026-25237)

Vulnerability from cvelistv5 – Published: 2026-02-03 18:29 – Updated: 2026-02-04 20:21
VLAI
Title
PEAR is Vulnerable to PHP Code Execution via preg_replace /e in Bug Update Emails
Summary
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, use of preg_replace() with the /e modifier in bug update email handling can enable PHP code execution if attacker-controlled content reaches the evaluated replacement. This issue has been patched in version 1.33.0.
Severity
9.2 (Critical)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-04 20:21 UTC
CWE
  • CWE-624 - Executable Regular Expression Error
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 8026 records in the last 180 days details
References
Impacted products
Vendor Product Version
pear pearweb Affected: < 1.33.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25237",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-04T20:21:43.501877Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-04T20:21:50.253Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pearweb",
          "vendor": "pear",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.33.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, use of preg_replace() with the /e modifier in bug update email handling can enable PHP code execution if attacker-controlled content reaches the evaluated replacement. This issue has been patched in version 1.33.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-624",
              "description": "CWE-624: Executable Regular Expression Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-03T18:29:54.001Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pear/pearweb/security/advisories/GHSA-vhw6-hqh9-8r23",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pear/pearweb/security/advisories/GHSA-vhw6-hqh9-8r23"
        }
      ],
      "source": {
        "advisory": "GHSA-vhw6-hqh9-8r23",
        "discovery": "UNKNOWN"
      },
      "title": "PEAR is Vulnerable to PHP Code Execution via preg_replace /e in Bug Update Emails"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25237",
    "datePublished": "2026-02-03T18:29:54.001Z",
    "dateReserved": "2026-01-30T14:44:47.329Z",
    "dateUpdated": "2026-02-04T20:21:50.253Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-41655 (GCVE-0-2024-41655)

Vulnerability from cvelistv5 – Published: 2024-07-23 14:49 – Updated: 2024-08-02 04:46
VLAI
Title
TF2 Item Format Regular Expression Denial of Service vulnerability
Summary
TF2 Item Format helps users format TF2 items to the community standards. Versions of `tf2-item-format` since at least `4.2.6` and prior to `5.9.14` are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when parsing crafted user input. This vulnerability can be exploited by an attacker to perform DoS attacks on any service that uses any `tf2-item-format` to parse user input. Version `5.9.14` contains a fix for the issue.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-23 14:57 UTC
CWE
  • CWE-624 - Executable Regular Expression Error
  • CWE-1333 - Inefficient Regular Expression Complexity
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 8026 records in the last 180 days details
References
Impacted products
Vendor Product Version
danocmx node-tf2-item-format Affected: >= 4.2.6, < 5.9.14
Create a notification for this product.
danocmx node-tf2-item-format Affected: 4.2.6 , < 5.9.14 (custom)
    cpe:2.3:a:danocmx:node-tf2-item-format:*:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:danocmx:node-tf2-item-format:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "node-tf2-item-format",
            "vendor": "danocmx",
            "versions": [
              {
                "lessThan": "5.9.14",
                "status": "affected",
                "version": "4.2.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41655",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-23T14:57:56.367784Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-25T15:59:34.101Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:46:52.666Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/danocmx/node-tf2-item-format/security/advisories/GHSA-8h55-q5qq-p685",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/danocmx/node-tf2-item-format/security/advisories/GHSA-8h55-q5qq-p685"
          },
          {
            "name": "https://github.com/danocmx/node-tf2-item-format/commit/5cffcc16a9261d6a937bda72bfe6830e02e31eec",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/danocmx/node-tf2-item-format/commit/5cffcc16a9261d6a937bda72bfe6830e02e31eec"
          },
          {
            "name": "https://github.com/danocmx/node-tf2-item-format/releases/tag/v5.9.14",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/danocmx/node-tf2-item-format/releases/tag/v5.9.14"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "node-tf2-item-format",
          "vendor": "danocmx",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.2.6, \u003c 5.9.14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TF2 Item Format helps users format TF2 items to the community standards. Versions of `tf2-item-format` since at least `4.2.6`  and prior to `5.9.14` are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when parsing crafted user input. This vulnerability can be exploited by an attacker to perform DoS attacks on any service that uses any `tf2-item-format` to parse user input. Version `5.9.14` contains a fix for the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-624",
              "description": "CWE-624: Executable Regular Expression Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1333",
              "description": "CWE-1333: Inefficient Regular Expression Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-23T14:49:34.078Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/danocmx/node-tf2-item-format/security/advisories/GHSA-8h55-q5qq-p685",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/danocmx/node-tf2-item-format/security/advisories/GHSA-8h55-q5qq-p685"
        },
        {
          "name": "https://github.com/danocmx/node-tf2-item-format/commit/5cffcc16a9261d6a937bda72bfe6830e02e31eec",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/danocmx/node-tf2-item-format/commit/5cffcc16a9261d6a937bda72bfe6830e02e31eec"
        },
        {
          "name": "https://github.com/danocmx/node-tf2-item-format/releases/tag/v5.9.14",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/danocmx/node-tf2-item-format/releases/tag/v5.9.14"
        }
      ],
      "source": {
        "advisory": "GHSA-8h55-q5qq-p685",
        "discovery": "UNKNOWN"
      },
      "title": "TF2 Item Format Regular Expression Denial of Service vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-41655",
    "datePublished": "2024-07-23T14:49:34.078Z",
    "dateReserved": "2024-07-18T15:21:47.481Z",
    "dateUpdated": "2024-08-02T04:46:52.666Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GHSA-8H55-Q5QQ-P685

Vulnerability from github – Published: 2024-07-23 14:10 – Updated: 2024-07-23 15:51
VLAI
Summary
(ReDoS) Regular Expression Denial of Service in tf2-item-format
Details

Summary

Versions of tf2-item-format since at least 4.2.6 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when parsing crafted user input.

Tested Versions

  • 5.9.13
  • 5.8.10
  • 5.7.0
  • 5.6.17
  • 4.3.5
  • 4.2.6

v5

Upgrade package to ^5.9.14

v4

No patch exists. Please consult the v4 to v5 migration guide to upgrade to v5.

If upgrading to v5 is not possible, fork the module repository and implement the fix detailed below.

Impact

This vulnerability can be exploited by an attacker to perform DoS attacks on any service that uses any tf2-item-format to parse user input.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.9.13"
      },
      "package": {
        "ecosystem": "npm",
        "name": "tf2-item-format"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.2.6"
            },
            {
              "fixed": "5.9.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-41655"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1333",
      "CWE-624"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-07-23T14:10:45Z",
    "nvd_published_at": "2024-07-23T15:15:05Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nVersions of `tf2-item-format` since at least `4.2.6` are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when parsing crafted user input. \n\n## Tested Versions\n\n- `5.9.13`\n- `5.8.10`\n- `5.7.0`\n- `5.6.17`\n- `4.3.5`\n- `4.2.6`\n\n### v5\nUpgrade package to `^5.9.14`\n\n### v4\nNo patch exists. Please consult the [v4 to v5 migration guide](https://github.com/danocmx/node-tf2-item-format?tab=readme-ov-file#migrating-from-v4-to-v5) to upgrade to v5.\n\nIf upgrading to v5 is not possible, fork the module repository and implement the fix detailed below.\n\n## Impact\n\nThis vulnerability can be exploited by an attacker to perform DoS attacks on any service that uses any `tf2-item-format` to parse user input.",
  "id": "GHSA-8h55-q5qq-p685",
  "modified": "2024-07-23T15:51:54Z",
  "published": "2024-07-23T14:10:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/danocmx/node-tf2-item-format/security/advisories/GHSA-8h55-q5qq-p685"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41655"
    },
    {
      "type": "WEB",
      "url": "https://github.com/danocmx/node-tf2-item-format/commit/5cffcc16a9261d6a937bda72bfe6830e02e31eec"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/danocmx/node-tf2-item-format"
    },
    {
      "type": "WEB",
      "url": "https://github.com/danocmx/node-tf2-item-format/releases/tag/v5.9.14"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "(ReDoS) Regular Expression Denial of Service in tf2-item-format"
}

GHSA-CVHH-7X6J-W7V5

Vulnerability from github – Published: 2026-10-09 09:31 – Updated: 2026-10-09 09:31
VLAI
Details

Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-97076"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-624"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-09T07:17:19Z",
    "severity": "HIGH"
  },
  "details": "Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5.",
  "id": "GHSA-cvhh-7x6j-w7v5",
  "modified": "2026-10-09T09:31:04Z",
  "published": "2026-10-09T09:31:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97076"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/wp-rocket/vulnerability/wordpress-wp-rocket-plugin-3-23-5-denial-of-service-attack-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-Q4HV-HFJ9-X4R5

Vulnerability from github – Published: 2026-10-23 21:36 – Updated: 2026-11-02 18:32
VLAI
Details

HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions.

_language_match interpolates each Accept-Language range into the pattern /^$range\-/i without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as (a?|b?){26}z backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range such as ( fails to compile.

A remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-113877"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-624"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-23T21:17:21Z",
    "severity": "HIGH"
  },
  "details": "HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions.\n\n_language_match interpolates each Accept-Language range into the pattern `/^$range\\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as `(a?|b?){26}z` backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range such as `(` fails to compile.\n\nA remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it.",
  "id": "GHSA-q4hv-hfj9-x4r5",
  "modified": "2026-11-02T18:32:01Z",
  "published": "2026-10-23T21:36:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113877"
    },
    {
      "type": "WEB",
      "url": "https://github.com/robrwo/perl-HTTP-Headers-ActionPack/commit/77f0deb23f3de872c2e64befd72750e0f0f4bec9.patch"
    },
    {
      "type": "WEB",
      "url": "https://metacpan.org/release/RRWO/HTTP-Headers-ActionPack-0.10/changes"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/10/23/27"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Implementation

The regular expression feature in some languages allows inputs to be quoted or escaped before insertion, such as \Q and \E in Perl.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list