TYPE DE FAIBLESSE

Déni de service par expression régulière (ReDoS) CWE-1333

41 CVE, des plus récentes aux plus anciennes. Définition MITRE de CWE-1333 (en anglais) →

CVE-2026-120217Delgan loguru version 0.7.3 est une bibliothèque Python utilisée pour la journalisation et le formatage des sorties console. La faille se situe dans l'analyseur de marquage de coul… 2.1 FAIBLE

CVE-2026-111714Les versions de tarteaucitron.js antérieures à la 1.37.0 constituent une bibliothèque JavaScript utilisée pour gérer les bannières de consentement aux cookies sur les sites web. La… 2.3 FAIBLE

CVE-2026-67240Les serveurs RabbitMQ utilisant des files d'attente de flux (stream queues) AMQP 1.0 sont affectés par une faille dans le traitement des filtres de messages. Un utilisateur authent… 2.3 FAIBLE

CVE-2026-41848Les applications utilisant le framework Spring sont vulnérables à une attaque par déni de service via des modèles d'URL spécifiquement conçus. Un attaquant non authentifié disposan… 3.7 FAIBLE

CVE-2026-11478Les applications utilisant la bibliothèque `tiny-regex-c` sont vulnérables à une attaque par déni de service via expressions régulières. Un attaquant authentifié disposant d'un acc… 1.9 FAIBLE

CVE-2026-10692Les utilisateurs de `code-index-mcp` (version 2.14.0 et versions antérieures) sont vulnérables à une attaque par déni de service basé sur des expressions régulières (ReDoS) via la … 2.1 FAIBLE

CVE-2026-10691DesktopCommanderMCP (versions 0.2.38 et antérieures) est susceptible de subir un déni de service par expression régulière (ReDoS) dans son gestionnaire de recherche. Un attaquant a… 2.1 FAIBLE

CVE-2026-40319Les utilisateurs du framework de test d'IA Giskard (versions antérieures à 1.0.2b1) sont concernés par une faille où une expression régulière malveillante peut faire planter le sys… 1.0 FAIBLE

CVE-2026-4539Pygments (jusqu'à la version 2.19.2) présente une faille dans son analyseur syntaxique (lexer) Archetype qui peut être déclenchée par une entrée spécifiquement conçue. Un attaquant… 1.9 FAIBLE

CVE-2026-3293Les applications utilisant le pilote JDBC Snowflake (version 4.0.1 et versions antérieures) sont vulnérables à une attaque par déni de service via expressions régulières. Un attaqu… 1.9 FAIBLE

CVE-2025-69873Les applications utilisant la bibliothèque `ajv` pour la validation de schémas JSON sont concernées si l'option `$data` est activée. Un attaquant peut envoyer un modèle d'expressio… 2.9 FAIBLE

CVE-2026-24001Les applications utilisant la bibliothèque JavaScript `jsdiff` pour analyser des correctifs de texte (patches) sont vulnérables à une attaque par déni de service. Un attaquant dist… 2.7 FAIBLE

CVE-2026-22691Les applications utilisant la bibliothèque Python `pypdf` en mode de lecture non strict sont vulnérables à ce problème. Un attaquant peut fournir un fichier PDF spécialement conçu … 2.7 FAIBLE

CVE-2025-68142PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. Versions prior to 10.16.1 have a ReDOS bug found within the figure caption extension (`pymdown… 2.7 FAIBLE

CVE-2025-61921Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-M… 2.7 FAIBLE

CVE-2025-7579A vulnerability was found in chinese-poetry 0.1. It has been rated as problematic. This issue affects some unknown processing of the file rank/server.js. The manipulation leads to … 2.1 FAIBLE

CVE-2025-7074A vulnerability classified as problematic has been found in vercel hyper up to 3.4.1. This affects the function expand/braceExpand/ignoreMap of the file hyper/bin/rimraf-standalone… 2.1 FAIBLE

CVE-2025-48059PowSyBl (Power System Blocks) is a framework to build power system oriented software. In com.powsybl:powsybl-iidm-criteria versions 6.3.0 to before 6.7.2 and com.powsybl:powsybl-co… 2.7 FAIBLE

CVE-2025-5895A vulnerability was found in Metabase 54.10. It has been classified as problematic. This affects the function parseDataUri of the file frontend/src/metabase/lib/dom.js. The manipul… 2.1 FAIBLE

CVE-2025-5892A vulnerability, which was classified as problematic, has been found in RocketChat up to 7.6.1. This issue affects the function parseMessage of the file /apps/meteor/app/irc/server… 2.1 FAIBLE

CVE-2025-5891A vulnerability classified as problematic was found in Unitech pm2 up to 6.0.6. This vulnerability affects unknown code of the file /lib/tools/Config.js. The manipulation leads to … 2.1 FAIBLE

CVE-2025-5889A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the fil… 1.3 FAIBLE

CVE-2025-4215A vulnerability was found in gorhill uBlock Origin up to 1.63.3b16. It has been classified as problematic. Affected is the function currentStateChanged of the file src/js/1p-filter… 2.3 FAIBLE

CVE-2024-9506Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability. 3.7 FAIBLE

CVE-2023-7279A vulnerability has been found in Secure Systems Engineering Connaisseur up to 3.3.0 and classified as problematic. This vulnerability affects unknown code of the file connaisseur/… 2.1 FAIBLE

CVE-2024-6434The Premium Addons for Elementor plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 4.10.35. This is due to pr… 3.1 FAIBLE

CVE-2024-28864SecureProps is a PHP library designed to simplify the encryption and decryption of property data in objects. A vulnerability in SecureProps version 1.2.0 and 1.2.1 involves a regex… 2.6 FAIBLE

CVE-2024-27088es5-ext contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into `function#copy` or `function#toStringTokens` may cause the s… 0.0 AUCUNE

CVE-2021-4437A vulnerability, which was classified as problematic, has been found in dbartholomae lambda-middleware frameguard up to 1.0.4. Affected by this issue is some unknown functionality … 3.5 FAIBLE

CVE-2023-26112All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)$(.*)$. **Note:** This is only exploit… 3.7 FAIBLE

CVE-2020-36661A vulnerability was found in Kong lua-multipart 0.5.8-1. It has been declared as problematic. This vulnerability affects the function is_header of the file src/multipart.lua. The m… 3.5 FAIBLE

CVE-2018-25077A vulnerability was found in melnaron mel-spintax. It has been rated as problematic. Affected by this issue is some unknown functionality of the file lib/spintax.js. The manipulati… 3.5 FAIBLE

CVE-2022-4891A vulnerability has been found in Sisimai up to 4.25.14p11 and classified as problematic. This vulnerability affects the function to_plain of the file lib/sisimai/string.rb. The ma… 3.5 FAIBLE

CVE-2020-36649A vulnerability was found in mholt PapaParse up to 5.1.x. It has been classified as problematic. Affected is an unknown function of the file papaparse.js. The manipulation leads to… 3.5 FAIBLE

CVE-2018-25074A vulnerability was found in Prestaul skeemas and classified as problematic. This issue affects some unknown processing of the file validators/base.js. The manipulation of the argu… 3.5 FAIBLE

CVE-2017-20165A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argumen… 3.5 FAIBLE

CVE-2021-4306A vulnerability classified as problematic has been found in cronvel terminal-kit up to 2.1.7. Affected is an unknown function. The manipulation leads to inefficient regular express… 3.5 FAIBLE

CVE-2021-4305A vulnerability was found in Woorank robots-txt-guard. It has been rated as problematic. Affected by this issue is the function makePathPattern of the file lib/patterns.js. The man… 3.5 FAIBLE

CVE-2018-25049A vulnerability was found in email-existence. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The manipulation leads to… 3.0 FAIBLE

CVE-2015-10005A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/html_re.js. The manipulation leads… 3.5 FAIBLE

CVE-2022-42965An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to t… 3.7 FAIBLE