Monthly
ReDoS in NLTK's tgrep module exposes applications to indefinite CPU saturation when user-controlled tgrep patterns containing /regex/ nodes reach the _tgrep_node_action function, which compiles and executes them via Python's re.search without validation or timeout. All NLTK versions before 3.10.3 are affected when tgrep_positions() or tgrep_compile() accept external input. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation is conditional on a non-default, externally-exposed API configuration.
Catastrophic regex backtracking in NLTK before 3.10.0 allows unauthenticated remote attackers to saturate CPU and deny service to all users sharing the Python process by supplying crafted patterns to the Text.findall() or TokenSearcher.findall() methods. Any Python application that exposes NLTK regex search functionality to user-controlled input is affected across all platforms. No public exploit has been identified at time of analysis, but the vulnerability class (ReDoS) is well-understood and trivial to weaponize once the targeted endpoint is known.
Denial-of-service in Nokogiri before 1.19.3 stems from three distinct ReDoS vulnerabilities in the CSS selector tokenizer, affecting string-literal and identifier tokenization. Any Ruby application passing attacker-controlled input to `Node#css`, `Node#at_css`, `Nokogiri::CSS.xpath_for`, `Searchable#search`, or `CSS::Parser#parse` is vulnerable to exponential regex backtracking that can exhaust CPU resources and deny service. No public exploit code has been identified at time of analysis, but the unauthenticated network attack surface and low exploitation complexity make this a high-priority patch target for Nokogiri-dependent Ruby applications.
Regular Expression Denial of Service in SAP S/4HANA (Private Cloud) allows unauthenticated remote attackers to exhaust server resources by supplying specially crafted input to a network-accessible endpoint that invokes a vulnerable third-party regex component (CWE-1333). Successful exploitation causes high availability impact with no confidentiality or integrity exposure, making this a targeted disruption risk against a critical ERP platform. No active exploitation has been confirmed - the vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis.
ReDoS (catastrophic regex backtracking) in Checkmate monitoring platform versions 3.5.1 through 3.9.1 allows an authenticated admin or superadmin to freeze the entire Node.js application for all users by supplying a malicious regular expression in an HTTP monitor's expectedValue field. The vulnerable code in AdvancedMatcher.ts evaluates the regex synchronously on the Node.js main event loop against an attacker-supplied HTTP response body with no timeout or worker isolation, causing complete availability loss. Fixed in v3.9.2 by replacing JavaScript's native RegExp with the RE2 library, which guarantees linear-time complexity. No public exploit or CISA KEV listing identified at time of analysis.
Catastrophic regex backtracking in NLTK's TweetTokenizer (all versions before 3.10.1) allows unauthenticated remote attackers to stall Python service processes by submitting a few kilobytes of crafted text containing alternating domain label separators. Because TweetTokenizer is explicitly designed to process untrusted social-media input, every public-facing API or pipeline that passes user text through TweetTokenizer.tokenize() or casual_tokenize() is directly exposed to per-request denial of service with no authentication required. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV; the fix is confirmed available in NLTK 3.10.1.
ReDoS in n8n's Filter and Switch nodes allows an authenticated workflow author to monopolize a worker thread indefinitely by supplying a catastrophic backtracking regex compiled via `new RegExp()` without complexity validation or execution timeout. Affected are n8n versions before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1; per-item execution amplifies the impact proportionally to dataset size, stalling all concurrent workflows on the same worker. No public exploit code or CISA KEV listing has been identified at time of analysis.
Catastrophic ReDoS in Logto's email subaddressing blocklist allows unauthenticated remote attackers to stall the Node.js event loop and deny service to all authentication functions. Logto versions prior to 1.41.0 construct a `RegExp` from the attacker-supplied domain segment of the submitted email, and the permissive input validator accepts multiple `@` signs and regex metacharacters — enabling exponential backtracking when a crafted payload is posted to the public `POST /api/experience/verification/verification-code` endpoint. The availability impact extends to login, token issuance, SSO, and the administrative console. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available.
Regex-driven denial of service in Grav CMS prior to 2.0.4 allows authenticated page editors to exhaust PHP worker CPU by injecting catastrophically backtracking regular expression patterns through the allowlisted `regex_replace` Twig filter. The vulnerable path exists in `GravExtension::regexReplace()`, which forwards editor-supplied patterns directly to `preg_replace()` without backtrack-limit enforcement or error recovery. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack is straightforward for any user who holds page-editor privileges on an affected instance with Twig content processing enabled.
CPU exhaustion via ReDoS in sqlparse affects all Python applications that pass caller-controlled SQL text to sqlparse.parse(), sqlparse.format(), or sqlparse.split() prior to version 0.6.0. The root cause is a backreference regex pattern in the dollar-quoted literal lexer that, combined with the per-position lexer loop, produces O(n²) CPU complexity when processing inputs containing many unique, unclosed dollar-quote openers or multiline comment delimiters — making it trivially exploitable from the network with no authentication. No public exploit code or CISA KEV listing has been identified at time of analysis, but the fix commit includes a purpose-built benchmark script that doubles as a functional reproduction guide.
ReDoS in NLTK's tgrep module exposes applications to indefinite CPU saturation when user-controlled tgrep patterns containing /regex/ nodes reach the _tgrep_node_action function, which compiles and executes them via Python's re.search without validation or timeout. All NLTK versions before 3.10.3 are affected when tgrep_positions() or tgrep_compile() accept external input. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation is conditional on a non-default, externally-exposed API configuration.
Catastrophic regex backtracking in NLTK before 3.10.0 allows unauthenticated remote attackers to saturate CPU and deny service to all users sharing the Python process by supplying crafted patterns to the Text.findall() or TokenSearcher.findall() methods. Any Python application that exposes NLTK regex search functionality to user-controlled input is affected across all platforms. No public exploit has been identified at time of analysis, but the vulnerability class (ReDoS) is well-understood and trivial to weaponize once the targeted endpoint is known.
Denial-of-service in Nokogiri before 1.19.3 stems from three distinct ReDoS vulnerabilities in the CSS selector tokenizer, affecting string-literal and identifier tokenization. Any Ruby application passing attacker-controlled input to `Node#css`, `Node#at_css`, `Nokogiri::CSS.xpath_for`, `Searchable#search`, or `CSS::Parser#parse` is vulnerable to exponential regex backtracking that can exhaust CPU resources and deny service. No public exploit code has been identified at time of analysis, but the unauthenticated network attack surface and low exploitation complexity make this a high-priority patch target for Nokogiri-dependent Ruby applications.
Regular Expression Denial of Service in SAP S/4HANA (Private Cloud) allows unauthenticated remote attackers to exhaust server resources by supplying specially crafted input to a network-accessible endpoint that invokes a vulnerable third-party regex component (CWE-1333). Successful exploitation causes high availability impact with no confidentiality or integrity exposure, making this a targeted disruption risk against a critical ERP platform. No active exploitation has been confirmed - the vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis.
ReDoS (catastrophic regex backtracking) in Checkmate monitoring platform versions 3.5.1 through 3.9.1 allows an authenticated admin or superadmin to freeze the entire Node.js application for all users by supplying a malicious regular expression in an HTTP monitor's expectedValue field. The vulnerable code in AdvancedMatcher.ts evaluates the regex synchronously on the Node.js main event loop against an attacker-supplied HTTP response body with no timeout or worker isolation, causing complete availability loss. Fixed in v3.9.2 by replacing JavaScript's native RegExp with the RE2 library, which guarantees linear-time complexity. No public exploit or CISA KEV listing identified at time of analysis.
Catastrophic regex backtracking in NLTK's TweetTokenizer (all versions before 3.10.1) allows unauthenticated remote attackers to stall Python service processes by submitting a few kilobytes of crafted text containing alternating domain label separators. Because TweetTokenizer is explicitly designed to process untrusted social-media input, every public-facing API or pipeline that passes user text through TweetTokenizer.tokenize() or casual_tokenize() is directly exposed to per-request denial of service with no authentication required. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV; the fix is confirmed available in NLTK 3.10.1.
ReDoS in n8n's Filter and Switch nodes allows an authenticated workflow author to monopolize a worker thread indefinitely by supplying a catastrophic backtracking regex compiled via `new RegExp()` without complexity validation or execution timeout. Affected are n8n versions before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1; per-item execution amplifies the impact proportionally to dataset size, stalling all concurrent workflows on the same worker. No public exploit code or CISA KEV listing has been identified at time of analysis.
Catastrophic ReDoS in Logto's email subaddressing blocklist allows unauthenticated remote attackers to stall the Node.js event loop and deny service to all authentication functions. Logto versions prior to 1.41.0 construct a `RegExp` from the attacker-supplied domain segment of the submitted email, and the permissive input validator accepts multiple `@` signs and regex metacharacters — enabling exponential backtracking when a crafted payload is posted to the public `POST /api/experience/verification/verification-code` endpoint. The availability impact extends to login, token issuance, SSO, and the administrative console. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available.
Regex-driven denial of service in Grav CMS prior to 2.0.4 allows authenticated page editors to exhaust PHP worker CPU by injecting catastrophically backtracking regular expression patterns through the allowlisted `regex_replace` Twig filter. The vulnerable path exists in `GravExtension::regexReplace()`, which forwards editor-supplied patterns directly to `preg_replace()` without backtrack-limit enforcement or error recovery. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack is straightforward for any user who holds page-editor privileges on an affected instance with Twig content processing enabled.
CPU exhaustion via ReDoS in sqlparse affects all Python applications that pass caller-controlled SQL text to sqlparse.parse(), sqlparse.format(), or sqlparse.split() prior to version 0.6.0. The root cause is a backreference regex pattern in the dollar-quoted literal lexer that, combined with the per-position lexer loop, produces O(n²) CPU complexity when processing inputs containing many unique, unclosed dollar-quote openers or multiline comment delimiters — making it trivially exploitable from the network with no authentication. No public exploit code or CISA KEV listing has been identified at time of analysis, but the fix commit includes a purpose-built benchmark script that doubles as a functional reproduction guide.