Monthly
Unauthenticated remote denial of service in Symfony's HttpFoundation component (v4.1.0-BETA1 up to 5.4.54, v6.0.0-BETA1 up to 6.4.46, v7.0.0-BETA1 up to 7.4.19, and v8.0.0-BETA1 up to 8.1.7) allows any attacker who can send an HTTP request to burn roughly a second of CPU per request by placing a run of whitespace before a separator in the Cache-Control header. The flaw is automatically reachable because HeaderBag invokes HeaderUtils::split() on Cache-Control every time a Request object is constructed, so no authentication, plugin, or special configuration is required; a single crafted request costs about 813 ms on PHP 8.5 (17 spaces in an 8 KB header), doubling with each additional space, so sustained denial of service requires a stream of such requests rather than one packet. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but vendor patches are released and the reachability is trivial, making this a practical denial-of-service risk rather than a theoretical one.
Denial of service in Nodemailer 3.0.0 through 10.0.12 lets a malicious or man-in-the-middle SMTP server stall the Node.js event loop by answering EHLO with a crafted '250-AUTH' line followed by a long whitespace run and a non-matching token, which drives quadratic backtracking in the four AUTH-mechanism detection regexes in SMTPConnection._actionEHLO. No authentication is required from the attacker (PR:N) and the trigger occurs before any authentication step, but the victim application must connect outbound to an attacker-controlled or interceptable SMTP endpoint, so deployments pinned to fixed, trusted, TLS-authenticated mail servers are substantially harder to exploit. Impact is confined to event-loop blocking and availability loss (no confidentiality or integrity effect), and no public exploit code was identified at time of analysis; the vendor fix is Nodemailer 10.0.13.
Regular expression denial of service in GitPython before 3.2.0 allows remote, unauthenticated attackers to exhaust CPU on applications that parse Git commit or tag objects taken from an attacker-controlled repository. The flaw is in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines, which slips into quadratic backtracking when those lines are padded with long space-filled sequences that lack a valid epoch or timezone. Impact is strictly availability (CVSS 4.0 VA:H with VC:N/VI:N) - there is no confidentiality or integrity exposure, so the 8.7 High score reflects CPU exhaustion only, not code execution or data compromise; no public exploit identified at time of analysis.
Denial of service in N3.js before 2.11.1 lets unauthenticated remote attackers stall Node.js applications that parse untrusted Turtle or N3 by supplying long runs of digits that never terminate a valid numeric literal, driving the N3Lexer number regular expression into quadratic backtracking that blocks the event loop. The flaw (CWE-1333) is reachable with AV:N/AC:L/PR:N/UI:N and results only in availability loss (VC:N/VI:N/VA:H in the vendor CVSS 4.0 vector; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H in independent assessment), with no confidentiality or integrity impact. It is not listed in CISA KEV and no public exploit identified at time of analysis, so real-world exposure is governed by whether the deployment actually feeds attacker-controlled RDF documents into N3.js parsing paths.
Authenticated users of Open WebUI 0.11.0 through 0.11.3 can stall server workers by getting the model to call the grep_knowledge_files or grep_chat_files file-search tools with a catastrophically backtracking regular expression, which blocks the async event loop for roughly two seconds on each repeated invocation. Exploitation requires a valid account with access to those tools (CVSS PR:L), so unauthenticated attackers cannot trigger it directly; the practical exposure is highest on multi-tenant, shared-account, or self-service-registration instances where untrusted users already hold logins. There is no public exploit identified at time of analysis, and the effect is transient availability degradation that must be sustained by repeated calls rather than a one-shot outage (CVSS 4.0 base 7.1; CVSS 3.1 A:H with no confidentiality or integrity impact).
Authenticated users holding only Viewer privileges on Satel Netco Design can degrade availability of the application by submitting specially crafted search input that drives excessive processing in the product's regular-expression handling. The issue affects all versions prior to v2.1.7 and is rated CVSS 7.1 (CVSS 4.0) / High under CVSS 3.1 for availability impact alone - there is no confidentiality or integrity loss. Exploitation requires a valid, low-privileged account and network reachability to the search functionality; no public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV).
Unauthenticated remote attackers can stall server-side rendering in Quasar Framework versions prior to 2.23.3 by sending a crafted User-Agent header that triggers catastrophic regex backtracking in Platform.parseSSR(). Because Platform is an auto-installed plugin, the header is parsed before routing on every SSR request, so a single malformed request keeps the Node.js event loop busy and delays or blocks all other SSR traffic - an availability-only impact (CVSS 4.0 base 8.7; our assessment CVSS 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Only SSR targets are exposed; SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation builds never feed an attacker-controlled header into this path. No public exploit identified at time of analysis, and no CISA KEV listing or EPSS score was provided in the source data.
Regular expression denial of service in mammoth.js 1.3.0 through 1.12.2 lets unauthenticated remote attackers stall the Node.js event loop by feeding a crafted .docx whose embedded style map contains an unterminated single-quoted string built from repeated backslash escape sequences. The flaw lives in the style-map tokeniser and triggers catastrophic regex backtracking, so any service that converts untrusted documents to HTML becomes trivially exhaustible, though exploitation is only realistic when the style map is drawn from attacker-supplied document content rather than static developer configuration. A vendor patch is available in 1.12.3; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Denial of service in the Lua language bindings of Apache Thrift allows unauthenticated remote attackers to exhaust CPU resources by supplying pathologically crafted input to a regular-expression or parsing code path in releases before 0.25.0, consistent with CWE-1333 (inefficient regular expression complexity). The CVSS 4.0 vector scores 8.2 with AT:P, indicating that a specific attack prerequisite must be met: the deployment must actually use the Lua bindings and attacker-controlled data must reach the vulnerable parsing path, so exploitation is not fully attacker-controlled. The vendor-released fix is Apache Thrift 0.25.0; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), with the effective risk concentrated in services that parse untrusted input through the Lua binding.
Polynomial-time regular expression denial of service (CWE-1333) in the crmne/ruby_llm Ruby gem's Mistral provider capability matching allows unauthenticated remote attackers to exhaust CPU and stall requests by feeding a crafted model-identifier string into the modalities_for/capabilities_for code path, but only on hosts running Ruby 3.1.x, whose regex engine lacks the linear-time matching optimization. Availability is the sole impacted property (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), and the practical limiter is deployment context: the host application must route untrusted, attacker-influenced model IDs into this matching logic, since hardcoded or whitelisted model IDs neutralize the vector. CISA SSVC records Exploitation: none and there is no public exploit identified at time of analysis; an upstream fix exists in commit dd3c84812598def03d4aff77b5447c41d8f5c34e.
Unauthenticated remote denial of service in Symfony's HttpFoundation component (v4.1.0-BETA1 up to 5.4.54, v6.0.0-BETA1 up to 6.4.46, v7.0.0-BETA1 up to 7.4.19, and v8.0.0-BETA1 up to 8.1.7) allows any attacker who can send an HTTP request to burn roughly a second of CPU per request by placing a run of whitespace before a separator in the Cache-Control header. The flaw is automatically reachable because HeaderBag invokes HeaderUtils::split() on Cache-Control every time a Request object is constructed, so no authentication, plugin, or special configuration is required; a single crafted request costs about 813 ms on PHP 8.5 (17 spaces in an 8 KB header), doubling with each additional space, so sustained denial of service requires a stream of such requests rather than one packet. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but vendor patches are released and the reachability is trivial, making this a practical denial-of-service risk rather than a theoretical one.
Denial of service in Nodemailer 3.0.0 through 10.0.12 lets a malicious or man-in-the-middle SMTP server stall the Node.js event loop by answering EHLO with a crafted '250-AUTH' line followed by a long whitespace run and a non-matching token, which drives quadratic backtracking in the four AUTH-mechanism detection regexes in SMTPConnection._actionEHLO. No authentication is required from the attacker (PR:N) and the trigger occurs before any authentication step, but the victim application must connect outbound to an attacker-controlled or interceptable SMTP endpoint, so deployments pinned to fixed, trusted, TLS-authenticated mail servers are substantially harder to exploit. Impact is confined to event-loop blocking and availability loss (no confidentiality or integrity effect), and no public exploit code was identified at time of analysis; the vendor fix is Nodemailer 10.0.13.
Regular expression denial of service in GitPython before 3.2.0 allows remote, unauthenticated attackers to exhaust CPU on applications that parse Git commit or tag objects taken from an attacker-controlled repository. The flaw is in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines, which slips into quadratic backtracking when those lines are padded with long space-filled sequences that lack a valid epoch or timezone. Impact is strictly availability (CVSS 4.0 VA:H with VC:N/VI:N) - there is no confidentiality or integrity exposure, so the 8.7 High score reflects CPU exhaustion only, not code execution or data compromise; no public exploit identified at time of analysis.
Denial of service in N3.js before 2.11.1 lets unauthenticated remote attackers stall Node.js applications that parse untrusted Turtle or N3 by supplying long runs of digits that never terminate a valid numeric literal, driving the N3Lexer number regular expression into quadratic backtracking that blocks the event loop. The flaw (CWE-1333) is reachable with AV:N/AC:L/PR:N/UI:N and results only in availability loss (VC:N/VI:N/VA:H in the vendor CVSS 4.0 vector; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H in independent assessment), with no confidentiality or integrity impact. It is not listed in CISA KEV and no public exploit identified at time of analysis, so real-world exposure is governed by whether the deployment actually feeds attacker-controlled RDF documents into N3.js parsing paths.
Authenticated users of Open WebUI 0.11.0 through 0.11.3 can stall server workers by getting the model to call the grep_knowledge_files or grep_chat_files file-search tools with a catastrophically backtracking regular expression, which blocks the async event loop for roughly two seconds on each repeated invocation. Exploitation requires a valid account with access to those tools (CVSS PR:L), so unauthenticated attackers cannot trigger it directly; the practical exposure is highest on multi-tenant, shared-account, or self-service-registration instances where untrusted users already hold logins. There is no public exploit identified at time of analysis, and the effect is transient availability degradation that must be sustained by repeated calls rather than a one-shot outage (CVSS 4.0 base 7.1; CVSS 3.1 A:H with no confidentiality or integrity impact).
Authenticated users holding only Viewer privileges on Satel Netco Design can degrade availability of the application by submitting specially crafted search input that drives excessive processing in the product's regular-expression handling. The issue affects all versions prior to v2.1.7 and is rated CVSS 7.1 (CVSS 4.0) / High under CVSS 3.1 for availability impact alone - there is no confidentiality or integrity loss. Exploitation requires a valid, low-privileged account and network reachability to the search functionality; no public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV).
Unauthenticated remote attackers can stall server-side rendering in Quasar Framework versions prior to 2.23.3 by sending a crafted User-Agent header that triggers catastrophic regex backtracking in Platform.parseSSR(). Because Platform is an auto-installed plugin, the header is parsed before routing on every SSR request, so a single malformed request keeps the Node.js event loop busy and delays or blocks all other SSR traffic - an availability-only impact (CVSS 4.0 base 8.7; our assessment CVSS 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Only SSR targets are exposed; SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation builds never feed an attacker-controlled header into this path. No public exploit identified at time of analysis, and no CISA KEV listing or EPSS score was provided in the source data.
Regular expression denial of service in mammoth.js 1.3.0 through 1.12.2 lets unauthenticated remote attackers stall the Node.js event loop by feeding a crafted .docx whose embedded style map contains an unterminated single-quoted string built from repeated backslash escape sequences. The flaw lives in the style-map tokeniser and triggers catastrophic regex backtracking, so any service that converts untrusted documents to HTML becomes trivially exhaustible, though exploitation is only realistic when the style map is drawn from attacker-supplied document content rather than static developer configuration. A vendor patch is available in 1.12.3; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Denial of service in the Lua language bindings of Apache Thrift allows unauthenticated remote attackers to exhaust CPU resources by supplying pathologically crafted input to a regular-expression or parsing code path in releases before 0.25.0, consistent with CWE-1333 (inefficient regular expression complexity). The CVSS 4.0 vector scores 8.2 with AT:P, indicating that a specific attack prerequisite must be met: the deployment must actually use the Lua bindings and attacker-controlled data must reach the vulnerable parsing path, so exploitation is not fully attacker-controlled. The vendor-released fix is Apache Thrift 0.25.0; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), with the effective risk concentrated in services that parse untrusted input through the Lua binding.
Polynomial-time regular expression denial of service (CWE-1333) in the crmne/ruby_llm Ruby gem's Mistral provider capability matching allows unauthenticated remote attackers to exhaust CPU and stall requests by feeding a crafted model-identifier string into the modalities_for/capabilities_for code path, but only on hosts running Ruby 3.1.x, whose regex engine lacks the linear-time matching optimization. Availability is the sole impacted property (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), and the practical limiter is deployment context: the host application must route untrusted, attacker-influenced model IDs into this matching logic, since hardcoded or whitelisted model IDs neutralize the vector. CISA SSVC records Exploitation: none and there is no public exploit identified at time of analysis; an upstream fix exists in commit dd3c84812598def03d4aff77b5447c41d8f5c34e.