Express security incidents

(GitPython before 3.1.60 contains a regular expression denial of servic ...)

(GitPython before 3.1.60 contains a regular expression denial of servic ...)

(The $regexFindAll expression can be used by an authenticated user who ...)

(The $regexFindAll expression can be used by an authenticated user who ...)

(An internal aggregation expression in MongoDB Server was incorrectly r ...)

(An internal aggregation expression in MongoDB Server was incorrectly r ...)

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or B

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix [a-z0-9]+

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix [a-z0-9]+(?:[.\-][a-z0-9]+)* is unbounded. Input consisting of many alternating label separators can be partitioned in exponentially many ways, and because the branch also requires a trailing top-level domain that such input never supplies, the engine explores those partitions before failing at each offset.

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_payload: fix mask build for partial field offload nft_payload_offload_mask() builds the offload match mask for a pay

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_payload: fix mask build for partial field offload nft_payload_offload_mask() builds the offload match mask for a payload expression that covers only part of a header field. For a partial IPv6 address match (field_len = 16, priv_len = 1) that shift is 1 << 120, which is undefined on the 32-bit int operand. It also trims only one word, so the remaining words stay 0xffffffff (and when priv_len is a multiple of 4 t

Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations

Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL expression did not. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, incl

SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \sf, and any similar usage in non-core tools. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, v

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16, 15, and 14, minor versions before PostgreSQL 18.5, 16.15, 15.19, and 14.24 are affected. PostgreSQL 17 is unaffected.

A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API that esc

A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API that escapes the sandbox and loads arbitrary Java classes on the server. This can potentially allow an attacker to gain access to confidential information and compromise integrity. The solution is to upgrade to Meridian 2024.3.12, 2025.0.9 and Horizon 36.0.3 or newer. Meridian and Horizon installation instr

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's maximum string length. When a global replace uses an output amplifying replacement template, the result can grow quadratically with the input size, and once the result exceeds V8's maximum string lengt

pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors (caret, tilde, betterem, and magiclink) use regular expr

pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors (caret, tilde, betterem, and magiclink) use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways, causing catastrophic backtracking. As a result, a single untrusted Markdown line under 50 bytes rendered with markdown.markdown() in each extension's default configuration drives the rendering thread

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify  builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow  f

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify  builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow  flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is treated as a regular expression rather than a literal string. Because GitHub permits characters such as  `.`  in organization, repository, and workflow path names and  `.`  is a regex wildcard, an att

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory co

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the nati

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final, incomplete code point. This could result in an out-of-bounds read and potential disclosure of adjacent memory contents. This issue is fixed in version 1.26.1.

DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions

DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, <%evil%>) inside <template> element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization

Spring Framework Denial of Service via Unbounded Cache in SpEL

Spring Framework Denial of Service via Unbounded Cache in SpEL

org.springframework:spring-expression: 7.0.0 → 7.0.8

Spring Framework Arbitrary Method Invocation in SpEL Expressions

Spring Framework Arbitrary Method Invocation in SpEL Expressions

org.springframework:spring-expression: 7.0.0 → 7.0.8

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

pygments: before 2.20.0

markdown-it is has a Regular Expression Denial of Service (ReDoS)

markdown-it is has a Regular Expression Denial of Service (ReDoS)

Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer

Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer

transformers: before 4.53.0

Hugging Face Transformers library has Regular Expression Denial of Service

Hugging Face Transformers library has Regular Expression Denial of Service

transformers: before 4.53.0

Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability

Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability

transformers: before 4.53.0

@pdfme/common vulnerable to to XSS and Prototype Pollution through its expression evaluation

@pdfme/common vulnerable to to XSS and Prototype Pollution through its expression evaluation

brace-expansion Regular Expression Denial of Service vulnerability

brace-expansion Regular Expression Denial of Service vulnerability

vLLM vulnerable to Regular Expression Denial of Service

vLLM vulnerable to Regular Expression Denial of Service

vllm: 0.6.3 → 0.9.0

Transformers Regular Expression Denial of Service (ReDoS) vulnerability

Transformers Regular Expression Denial of Service (ReDoS) vulnerability

transformers: before 4.50.0

Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter

Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter

Transformers Regular Expression Denial of Service (ReDoS) vulnerability

Transformers Regular Expression Denial of Service (ReDoS) vulnerability

transformers: before 4.48.0

CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement

CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement

cgi: before 0.3.5.1

@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking

Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit

Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit

express vulnerable to XSS via response.redirect()

express vulnerable to XSS via response.redirect()

Spring Framework vulnerable to Denial of Service

Spring Framework vulnerable to Denial of Service

org.springframework:spring-expression: before 5.3.39

Regular Expression Denial of Service (ReDoS) in micromatch

Regular Expression Denial of Service (ReDoS) in micromatch

Express.js Open Redirect in malformed URLs

Express.js Open Redirect in malformed URLs

Black vulnerable to Regular Expression Denial of Service (ReDoS)

Black vulnerable to Regular Expression Denial of Service (ReDoS)

black: before 24.3.0

Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing

Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing

angular vulnerable to regular expression denial of service via the <input type="url"> element

angular vulnerable to regular expression denial of service via the <input type="url"> element

angular vulnerable to regular expression denial of service via the $resource service

angular vulnerable to regular expression denial of service via the $resource service

angular vulnerable to regular expression denial of service via the angular.copy() utility

angular vulnerable to regular expression denial of service via the angular.copy() utility

Vega Expression Language `scale` expression function Cross Site Scripting

Vega Expression Language `scale` expression function Cross Site Scripting

angular vulnerable to regular expression denial of service (ReDoS)

angular vulnerable to regular expression denial of service (ReDoS)

Regular Expression Denial of Service in browserslist

Regular Expression Denial of Service in browserslist

Regular expression denial of service in @absolunet/kafe

Regular expression denial of service in @absolunet/kafe

Regular Expression Denial of Service (REDoS) in Marked

Regular Expression Denial of Service (REDoS) in Marked

Regular Expression Denial of Service in debug

Regular Expression Denial of Service in debug