CVE-2025-1333
published 2025-05-01CVE-2025-1333: IBM MQ Container when used with the IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0…
PriorityP335medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.23%
13.9th percentile
IBM MQ Container when used with the IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, and MQ Operator SC2 3.2.0 through 3.2.10 and configured with Cloud Pak for Integration Keycloak could disclose sensitive information to a privileged user.
Affected
127 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 9001 | copyparty | >= 0 < 1.18.9 | 1.18.9 |
| babel | helpers | >= 0 < 7.26.10 | 7.26.10 |
| babel | helpers | >= 8.0.0-alpha.0 < 8.0.0-alpha.17 | 8.0.0-alpha.17 |
| babel | runtime | >= 0 < 7.26.10 | 7.26.10 |
| babel | runtime | >= 8.0.0-alpha.0 < 8.0.0-alpha.17 | 8.0.0-alpha.17 |
| babel | runtime-corejs2 | >= 0 < 7.26.10 | 7.26.10 |
| babel | runtime-corejs2 | >= 8.0.0-alpha.0 < 8.0.0-alpha.17 | 8.0.0-alpha.17 |
| babel | runtime-corejs3 | >= 0 < 7.26.10 | 7.26.10 |
| babel | runtime-corejs3 | >= 8.0.0-alpha.0 < 8.0.0-alpha.17 | 8.0.0-alpha.17 |
| devrafalko | string-math | 0 – 1.2.2 | — |
| facelessuser | pymdown-extensions | >= 0 < 10.16.1 | 10.16.1 |
| github.com | apache_trafficcontrol_v8 | 0 – 8.0.2 | — |
| huggingface | transformers | >= 0 < 4.50.0 | 4.50.0 |
| huggingface | transformers | >= 0 < 4.53.0 | 4.53.0 |
| huggingface | transformers | >= 0 < 4.52.1 | 4.52.1 |
| ibm | mq_operator | — | — |
| ibm | mq_operator | — | — |
| ibm | mq_operator | — | — |
| ibm | mq_operator | — | — |
| ibm | mq_operator | — | — |
| ibm | mq_operator | — | — |
| ibm | mq_operator | — | — |
| ibm | mq_operator | — | — |
| ibm | mq_operator | 2.0.0 – 2.0.29 | — |
| ibm | mq_operator | 2.0.0 LTS – 2.0.29 LTS | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
vendor_msrc7.7HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
PyMdown Extensions has a ReDOS bug in its Figure Capture extension
ghsa·2025-12-16
CVE-2025-68142 [LOW] CWE-1333 PyMdown Extensions has a ReDOS bug in its Figure Capture extension
PyMdown Extensions has a ReDOS bug in its Figure Capture extension
### Impact
This issue describes a ReDOS bug found within the figure caption extension (`pymdownx.blocks.caption` ).
In systems that take unchecked user content, this could cause long hangs when processing the data if a malicious payload was crafted.
### Patches
This issue is patched in Release [10.16.1](https://pypi.org/project/pymdown-extensions/10.16.1/).
### Workarounds
Some possible workarounds
If users are concerned about this vulnerability and process unknown user content without timeouts or other safeguards in place to prevent really large, malicious content being aimed at systems, the use of `pymdownx.blocks.caption` could be avoided until the library is updated to 10.16.1+.
### References
The original iss
GHSA
Apache Traffic Control has an Inefficient Regular Expression Complexity vulnerability
ghsa·2025-10-16
CVE-2025-61581 [LOW] CWE-1333 Apache Traffic Control has an Inefficient Regular Expression Complexity vulnerability
Apache Traffic Control has an Inefficient Regular Expression Complexity vulnerability
*** UNSUPPORTED WHEN ASSIGNED ***
Inefficient Regular Expression Complexity vulnerability in Apache Traffic Control.
This issue affects Apache Traffic Control: all versions.
People with access to the management interface of the Traffic Router component could specify malicious patterns and cause unavailability.
As this project is retired, it is not planned to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
GHSA
Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer
ghsa·2025-09-12
CVE-2025-6638 [MEDIUM] CWE-1333 Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer
Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically affecting the MarianTokenizer's `remove_language_code()` method. This vulnerability is present in version 4.52.4 and has been fixed in version 4.53.0. The issue arises from inefficient regex processing, which can be exploited by crafted input strings containing malformed language code patterns, leading to excessive CPU consumption and potential denial of service.
GHSA
Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity
ghsa·2025-09-09
CVE-2025-58451 [HIGH] CWE-1333 Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity
Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity
### Overview
A security review of the Cattown identified multiple weaknesses that could potentially impact its stability and security.
### Affected Versions
- All versions below 1.0.2
### Description of Vulnerabilities
1. CWE-1333: Inefficient Regular Expression Complexity
The package used regular expressions with inefficient, potentially exponential worst-case complexity. This can cause excessive CPU usage due to excessive backtracking on crafted inputs, potentially leading to denial of service.
2. CWE-400: Uncontrolled Resource Consumption (Resource Exhaustion)
The package was vulnerable to resource exhaustion, where processing malicious inputs could cause high CPU or memory us
GHSA
Withdrawn Advisory: Microsoft Knack ReDoS Vulnerability in the Introspection Module
ghsa·2025-08-20
CVE-2025-54364 [LOW] CWE-1333 Withdrawn Advisory: Microsoft Knack ReDoS Vulnerability in the Introspection Module
Withdrawn Advisory: Microsoft Knack ReDoS Vulnerability in the Introspection Module
### Withdrawn Advisory
This advisory has been withdrawn because the attack surface of this vulnerability is outside of Knack's intended functionality. The maintainer states the following:
> These CVEs are invalid. Knack is a CLI framework used by [Azure CLI](https://github.com/Azure/azure-cli). It's a local library, not a web service. In addition, the regex is used to extract function and parameter docstrings from the source code. It is not used to match user input. Therefore, it does not expose any attack surface. There is no way to use it for ReDoS attack.
This link is maintained to preserve external references.
### Original Description
Microsoft Knack 0.12.0 allows Regular expression Denial of Servic
GHSA
Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability
ghsa·2025-08-06
CVE-2025-5197 [MEDIUM] CWE-1333 Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability
Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically in the `convert_tf_weight_name_to_pt_weight_name()` function. This function, responsible for converting TensorFlow weight names to PyTorch format, uses a regex pattern `/[^/]*___([^/]*)/` that can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. The vulnerability affects versions up to 4.51.3 and is fixed in version 4.53.0. This issue can lead to service disruption, resource exhaustion, and potential API service vulnerabilities, impacting model conversion processes between TensorFlow and PyTorch formats.
GHSA
copyparty allows Regex Denial of Service (ReDoS) in the upload listing
ghsa·2025-08-04
CVE-2025-54796 [HIGH] CWE-1333 copyparty allows Regex Denial of Service (ReDoS) in the upload listing
copyparty allows Regex Denial of Service (ReDoS) in the upload listing
### Summary
The `filter` parameter for the "Recent uploads" page allows arbitrary Regexes. If this feature is enabled (which is the default), an attacker can craft a filter which deadlocks the server.
### PoC
`https://127.0.0.1:3923/?ru&filter=(.+)+x`
### Impact
The server becomes fully inaccessible for a long time.
GHSA
FastAPI Guard has a regex bypass
ghsa·2025-07-23
CVE-2025-54365 [HIGH] CWE-1333 FastAPI Guard has a regex bypass
FastAPI Guard has a regex bypass
### Summary
The regular expression patched to mitigate the ReDoS vulnerability by limiting the length of string fails to catch inputs that exceed this limit.
### Details
In version 3.0.1, you can find a commit like the one in the link below, which was made to prevent ReDoS.
https://github.com/rennf93/fastapi-guard/commit/d9d50e8130b7b434cdc1b001b8cfd03a06729f7f
This commit mitigates the vulnerability by limiting the length of the input string, as shown in the example below.
`r"]*>[^"` -> `]{0,100}>[^`
This type of patch fails to catch cases where the string representing the attributes of a tag exceeds 100 characters.
Therefore, most of the regex patterns present in version 3.0.1 can be bypassed.
### PoC
1. clone the fastapi-guard repository
2. Navig
GHSA
Transformers is vulnerable to ReDoS attack through its DonutProcessor class
ghsa·2025-07-11
CVE-2025-3933 [MEDIUM] CWE-1333 Transformers is vulnerable to ReDoS attack through its DonutProcessor class
Transformers is vulnerable to ReDoS attack through its DonutProcessor class
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's `token2json()` method. This vulnerability affects versions 4.51.3 and earlier, and is fixed in version 4.52.1. The issue arises from the regex pattern `` which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to service disruption, resource exhaustion, and potential API service vulnerabilities, impacting document processing tasks using the Donut model.
GHSA
fastapi-guard is vulnerable to ReDoS through inefficient regex
ghsa·2025-07-07
CVE-2025-53539 [MEDIUM] CWE-1333 fastapi-guard is vulnerable to ReDoS through inefficient regex
fastapi-guard is vulnerable to ReDoS through inefficient regex
### Summary
fastapi-guard detects penetration attempts by using regex patterns to scan incoming requests. However, some of the regex patterns used in detection are extremely inefficient and can cause polynomial complexity backtracks when handling specially crafted inputs.
It is not as severe as _exponential_ complexity ReDoS, but still downgrades performance and allows DoS exploits. An attacker can trigger high cpu usage and make a service unresponsive for hours by sending a single request in size of KBs.
### PoC
e.g. https://github.com/rennf93/fastapi-guard/blob/1e6c2873bfc7866adcbe5fc4da72f2d79ea552e7/guard/handlers/suspatterns_handler.py#L31C79-L32C7
```python
payload = lambda n: '15min)
```
Single-threaded uvicorn wo
GHSA
string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS)
ghsa·2025-06-30
CVE-2025-45143 [LOW] CWE-1333 string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS)
string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS)
string-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input.
GHSA
PowSyBl Core contains Polynomial REDoS’es
ghsa·2025-06-19
CVE-2025-48058 [MEDIUM] CWE-1333 PowSyBl Core contains Polynomial REDoS’es
PowSyBl Core contains Polynomial REDoS’es
### Impact
_What kind of vulnerability is it? Who is impacted?_
This is an advisory for a **potential polynomial Regular Expression Denial of Service (ReDoS)** vulnerability in the PowSyBl's DataSource mechanism. When the `listNames(String regex)` method is called on a DataSource, the user-supplied regular expression (which may be unvalidated) is compiled and evaluated against a collection of file-like resource names.
To trigger a **polynomial ReDoS** via this mechanism, **two attacker-controlled conditions** must be met:
- **Control over the regex input** passed into `listNames(String regex)`.
- _Example:_ An attacker supplies a malicious pattern like `(.*a){10000}`.
- **Control or influence over the file/resource names** being matched.
- _Exam
GHSA
taro-css-to-react-native Regular Expression Denial of Service vulnerability
ghsa·2025-06-09
CVE-2025-5896 [MEDIUM] CWE-1333 taro-css-to-react-native Regular Expression Denial of Service vulnerability
taro-css-to-react-native Regular Expression Denial of Service vulnerability
A vulnerability was found in tarojs taro up to 4.1.1. It has been declared as problematic. This vulnerability affects unknown code of the file taro/packages/css-to-react-native/src/index.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. Upgrading to version 4.1.2 is able to address this issue. The name of the patch is c2e321a8b6fc873427c466c69f41ed0b5e8814bf. It is recommended to upgrade the affected component.
GHSA
@vue/cli-plugin-pwa Regular Expression Denial of Service vulnerability
ghsa·2025-06-09
CVE-2025-5897 [MEDIUM] CWE-1333 @vue/cli-plugin-pwa Regular Expression Denial of Service vulnerability
@vue/cli-plugin-pwa Regular Expression Denial of Service vulnerability
A vulnerability was found in vuejs vue-cli up to 5.0.8. It has been rated as problematic. This issue affects the function HtmlPwaPlugin of the file packages/@vue/cli-plugin-pwa/lib/HtmlPwaPlugin.js of the component Markdown Code Handler. The manipulation leads to inefficient regular expression complexity. The attack may be initiated remotely.
GHSA
GHSA-fhjf-qcr2-g8m7: IBM MQ Container when used with the IBM MQ Operator LTS 2
ghsa_unreviewed·2025-05-02
CVE-2025-1333 [MEDIUM] CWE-214 GHSA-fhjf-qcr2-g8m7: IBM MQ Container when used with the IBM MQ Operator LTS 2
IBM MQ Container when used with the IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, and MQ Operator SC2 3.2.0 through 3.2.10 and configured with Cloud Pak for Integration Keycloak could disclose sensitive information to a privileged user.
GHSA
Transformers Regular Expression Denial of Service (ReDoS) vulnerability
ghsa·2025-04-29
CVE-2025-1194 [MEDIUM] CWE-1333 Transformers Regular Expression Denial of Service (ReDoS) vulnerability
Transformers Regular Expression Denial of Service (ReDoS) vulnerability
A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file `tokenization_gpt_neox_japanese.py` of the GPT-NeoX-Japanese model. The vulnerability occurs in the SubWordJapaneseTokenizer class, where regular expressions process specially crafted inputs. The issue stems from a regex exhibiting exponential complexity under certain conditions, leading to excessive backtracking. This can result in high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.48.1 (latest).
GHSA
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
ghsa·2025-03-11
CVE-2025-27789 [MEDIUM] CWE-1333 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
### Impact
When using Babel to compile [regular expression named capturing groups](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Regular_expressions/Named_capturing_group), Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`).
Your generated code is vulnerable if _all_ the following conditions are true:
- You use Babel to compile [regular expression named capturing groups](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Regular_expressions/Named_capturing_group)
- You use the `.replace` method on a regular expressi
GHSA
@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
ghsa·2025-02-14
CVE-2025-25288 [MEDIUM] CWE-1333 @octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
### Summary
For the npm package `@octokit/plugin-paginate-rest`, when calling `octokit.paginate.iterator()`, a specially crafted `octokit` instance—particularly with a malicious `link` parameter in the `headers` section of the `request`—can trigger a ReDoS attack.
### Details
The issue occurs at [line 39](https://github.com/octokit/plugin-paginate-rest.js/blob/main/src/iterator.ts) of iterator.ts in the @octokit/plugin-paginate-rest repository. The relevant code is as follows:
```js
url = ((normalizedResponse.headers.link || "").match(
/]+)>;\s*rel="next"/,
) || [])[1];
```
The regular expression `/]+)>;\s*rel="next"/` may lead to a potential backtracking vulne
GHSA
parse-duration has a Regex Denial of Service that results in event loop delay and out of memory
ghsa·2025-02-12
CVE-2025-25283 [HIGH] CWE-1333 parse-duration has a Regex Denial of Service that results in event loop delay and out of memory
parse-duration has a Regex Denial of Service that results in event loop delay and out of memory
### Summary
This report finds 2 availability issues due to the regex used in the `parse-duration` npm package:
1. An event loop delay due to the CPU-bound operation of resolving the provided string, from a 0.5ms and up to ~50ms per one operation, with a varying size from 0.01 MB and up to 4.3 MB respectively.
2. An out of memory that would crash a running Node.js application due to a string size of roughly 10 MB that utilizes unicode characters.
### PoC
Refer to the following proof of concept code that provides a test case and makes use of the regular expression in the library as its test case to match against strings:
```js
// Vulnerable regex to use from the library:
import parse from './
GHSA
Inefficient Regular Expression Complexity in koa
ghsa·2025-02-12
CVE-2025-25200 [CRITICAL] CWE-1333 Inefficient Regular Expression Complexity in koa
Inefficient Regular Expression Complexity in koa
### Summary
Koa uses an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a Denial-of-Service attack.
### PoC
Coming soon.
### Impact
This is a Regex Denial-of-Service attack and causes memory exhaustion. The regex should be improved and empty values should not be allowed.
Red Hat
ajv: ReDoS via $data reference
vendor_redhat·2026-02-11·CVSS 2.9
CVE-2025-69873 [LOW] CWE-1333 ajv: ReDoS via $data reference
ajv: ReDoS via $data reference
ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.
A flaw w
Microsoft
ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Poin
vendor_msrc·2026-02-10·CVSS 2.9
CVE-2025-69873 [LOW] CWE-1333 ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Poin
ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation.
Mariner: Mariner
mitre: mitre
Customer Action Required: Yes
Red Hat
PyMdown: pymdown-extensions: PyMdown Extensions: Regular Expression Denial of Service in figure caption extension
vendor_redhat·2025-12-16·CVSS 2.7
CVE-2025-68142 [LOW] CWE-1333 PyMdown: pymdown-extensions: PyMdown Extensions: Regular Expression Denial of Service in figure caption extension
PyMdown: pymdown-extensions: PyMdown Extensions: Regular Expression Denial of Service in figure caption extension
PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. Versions prior to 10.16.1 have a ReDOS bug found within the figure caption extension (`pymdownx.blocks.caption`). In systems that take unchecked user content, this could cause long hanges when processing the data if a malicious payload was crafted. This issue is patched in Release 10.16.1. As a workaround, those who process unknown user content without timeouts or other safeguards in place to prevent really large, malicious content being aimed at systems may avoid the use of `pymdownx.blocks.caption` until they're able to upgrade.
A flaw was found in PyMdown Extensions. This vulnerability al
Red Hat
tornado: Tornado Quadratic DoS via Crafted Multipart Parameters
vendor_redhat·2025-12-12·CVSS 7.5
CVE-2025-67726 [HIGH] CWE-1333 tornado: Tornado Quadratic DoS via Crafted Multipart Parameters
tornado: Tornado Quadratic DoS via Crafted Multipart Parameters
Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for
Red Hat
sinatra: Sinatra has ReDoS vulnerability in ETag header value generation
vendor_redhat·2025-10-10·CVSS 2.7
CVE-2025-61921 [LOW] CWE-1333 sinatra: Sinatra has ReDoS vulnerability in ETag header value generation
sinatra: Sinatra has ReDoS vulnerability in ETag header value generation
Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue.
A flaw was found in Sinatra. A Regular Expression Denial of Servic
Red Hat
transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers
vendor_redhat·2025-09-14·CVSS 5.3
CVE-2025-6051 [MEDIUM] CWE-1333 transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers
transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the `normalize_numbers()` method of the `EnglishNormalizer` class. This vulnerability affects versions up to 4.52.4 and is fixed in version 4.53.0. The issue arises from the method's handling of numeric strings, which can be exploited using crafted input strings containing long sequences of digits, leading to excessive CPU consumption. This vulnerability impacts text-to-speech and number normalization tasks, potentially causing service disruption, resource exhaustion, and API vulnerabilities.
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered
Red Hat
yarn: yarnpkg regular expression denial of service
vendor_redhat·2025-08-21·CVSS 4.8
CVE-2025-9308 [MEDIUM] CWE-1333 yarn: yarnpkg regular expression denial of service
yarn: yarnpkg regular expression denial of service
A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. Such manipulation leads to inefficient regular expression complexity. Local access is required to approach this attack. This vulnerability only affects products that are no longer supported by the maintainer.
A regular expression denial of service flaw has been found in the `yarn` npm module. An attacker with local access can manipulate input to the function `setOptions` in such a way that the yarnpkg program becomes unresponsive.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use a
Red Hat
prettier: prettier parseNestedCSS ReDoS
vendor_redhat·2025-07-28·CVSS 5.3
CVE-2025-8263 CWE-1333 prettier: prettier parseNestedCSS ReDoS
prettier: prettier parseNestedCSS ReDoS
A regular expression denial of service flaw has been discovered in the prettier code formatter tool. This flaw allows and attacker who has access to input source files to induce a denial of service.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Package: io.cryostat-cryostat (Cryostat 4) - Fix deferred
Package: migration-toolkit-virtualization/mtv-console-plugin-rhel9 (Migration Toolkit for Virtualization) - Fix deferred
Package: mtv-candidate/mtv-console-plugin-rhel9 (Migration Toolkit for Virtualization) - Fix deferred
Package: multicluster-global
Red Hat
transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers
vendor_redhat·2025-07-11·CVSS 5.3
CVE-2025-3933 [MEDIUM] CWE-1333 transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers
transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the DonutProcessor class's `token2json()` method. This vulnerability affects versions 4.50.3 and earlier, and is fixed in version 4.52.1. The issue arises from the regex pattern `` which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to service disruption, resource exhaustion, and potential API service vulnerabilities, impacting document processing tasks using the Donut model.
A regular expression denial of service flaw has been discovered in the Hugging Face Transformers
Red Hat
transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers
vendor_redhat·2025-07-07·CVSS 7.5
CVE-2025-3262 [HIGH] CWE-1333 transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers
transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the `SETTING_RE` variable within the `transformers/commands/chat.py` file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potentially result in a denial-of-service (DoS) when handling specially crafted input strings. The issue is fixed in version 4.51.0.
A Regular Expression Denial of Service (ReDoS) vulnerability has been discovered in t
Red Hat
transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers
vendor_redhat·2025-07-07·CVSS 5.3
CVE-2025-3264 [MEDIUM] CWE-1333 transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers
transformers: Regular Expression Denial of Service (ReDoS) in huggingface/transformers
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically in the `get_imports()` function within `dynamic_module_utils.py`. This vulnerability affects versions 4.49.0 and is fixed in version 4.51.0. The issue arises from a regular expression pattern `\s*try\s*:.*?except.*?:` used to filter out try/except blocks from Python code, which can be exploited to cause excessive CPU consumption through crafted input strings due to catastrophic backtracking. This vulnerability can lead to remote code loading disruption, resource exhaustion in model serving, supply chain attack vectors, and development pipeline disruption.
A Regular Expressi
Microsoft
HTMLParser quadratic complexity when processing malformed inputs
vendor_msrc·2025-06-10·CVSS 4.3
CVE-2025-6069 [MEDIUM] CWE-1333 HTMLParser quadratic complexity when processing malformed inputs
HTMLParser quadratic complexity when processing malformed inputs
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
PSF: PSF
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://
Red Hat
brace-expansion: juliangruber brace-expansion index.js expand redos
vendor_redhat·2025-06-09·CVSS 2.3
CVE-2025-5889 [LOW] CWE-1333 brace-expansion: juliangruber brace-expansion index.js expand redos
brace-expansion: juliangruber brace-expansion index.js expand redos
A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.
A denial-of-service (DoS) vulnerability has been identified in the brace-expansi
Red Hat
vllm: vLLM has a Regular Expression Denial of Service (ReDoS) Vulnerability
vendor_redhat·2025-05-30·CVSS 6.5
CVE-2025-48887 [MEDIUM] CWE-1333 vllm: vLLM has a Regular Expression Denial of Service (ReDoS) Vulnerability
vllm: vLLM has a Regular Expression Denial of Service (ReDoS) Vulnerability
vLLM, an inference and serving engine for large language models (LLMs), has a Regular Expression Denial of Service (ReDoS) vulnerability in the file `vllm/entrypoints/openai/tool_parsers/pythonic_tool_parser.py` of versions 0.6.4 up to but excluding 0.9.0. The root cause is the use of a highly complex and nested regular expression for tool call detection, which can be exploited by an attacker to cause severe performance degradation or make the service unavailable. The pattern contains multiple nested quantifiers, optional groups, and inner repetitions which make it vulnerable to catastrophic backtracking. Version 0.9.0 contains a patch for the issue.
A regular expression denial of service (ReDoS) flaw was found i
Red Hat
vllm: vLLM phi4mm: Quadratic Time Complexity in Input Token Processing leads to denial of service
vendor_redhat·2025-04-30·CVSS 6.5
CVE-2025-46560 [MEDIUM] CWE-1333 vllm: vLLM phi4mm: Quadratic Time Complexity in Input Token Processing leads to denial of service
vllm: vLLM phi4mm: Quadratic Time Complexity in Input Token Processing leads to denial of service
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.8.0 and prior to 0.8.5 are affected by a critical performance vulnerability in the input preprocessing logic of the multimodal tokenizer. The code dynamically replaces placeholder tokens (e.g., , ) with repeated tokens based on precomputed lengths. Due to inefficient list concatenation operations, the algorithm exhibits quadratic time complexity (O(n²)), allowing malicious actors to trigger resource exhaustion via specially crafted inputs. This issue has been patched in version 0.8.5.
A flaw was found in the vllm component. The affected versions of vllm have a performance v
Red Hat
octokit/endpoint: @octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
vendor_redhat·2025-02-14·CVSS 5.3
CVE-2025-25285 [MEDIUM] CWE-1333 octokit/endpoint: @octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
octokit/endpoint: @octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
@octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version 10.1.3, by crafting specific `options` parameters, the `endpoint.parse(options)` call can be triggered, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang and results in high CPU utilization. The issue occurs in the `parse` function within the `parse.ts` file of the npm package `@octokit/endpoint`. Version 10.1.3 contains a patch for the issue.
A flaw was found in the octokit/endpoint package for Node.js. In affected versions, the `endpoint.parse(options)` call can be triggered via special
Red Hat
octokit/plugin-paginate-rest: @octokit/plugin-paginate-rest has a Regular Expression in iterator that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
vendor_redhat·2025-02-14·CVSS 5.3
CVE-2025-25288 [MEDIUM] CWE-1333 octokit/plugin-paginate-rest: @octokit/plugin-paginate-rest has a Regular Expression in iterator that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
octokit/plugin-paginate-rest: @octokit/plugin-paginate-rest has a Regular Expression in iterator that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
@octokit/plugin-paginate-rest is the Octokit plugin to paginate REST API endpoint responses. For versions starting in 1.0.0 and prior to 11.4.1 of the npm package `@octokit/plugin-paginate-rest`, when calling `octokit.paginate.iterator()`, a specially crafted `octokit` instance—particularly with a malicious `link` parameter in the `headers` section of the `request`—can trigger a ReDoS attack. Version 11.4.1 contains a fix for the issue.
A flaw was found in the plugin-paginate-rest Octokit plugin. When calling `octokit.paginate.iterator()`, a specially crafted `octokit` instance with a malicious `link` parameter in the `headers
Red Hat
octokit/request: @octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
vendor_redhat·2025-02-14·CVSS 5.3
CVE-2025-25290 [MEDIUM] CWE-1333 octokit/request: @octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
octokit/request: @octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
@octokit/request sends parameterized requests to GitHub’s APIs with sensible defaults in browsers and Node. Starting in version 1.0.0 and prior to versions 9.2.1 and 8.4.1, the regular expression `/]+)>; rel="deprecation"/` used to match the `link` header in HTTP responses is vulnerable to a ReDoS (Regular Expression Denial of Service) attack. This vulnerability arises due to the unbounded nature of the regex's matching behavior, which can lead to catastrophic backtracking when processing specially crafted input. An attacker could exploit this flaw by sending a malicious `link` header, resulting in excessive CPU usage and potentially causing the ser
Red Hat
@octokit/request-error: @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
vendor_redhat·2025-02-14·CVSS 5.3
CVE-2025-25289 [MEDIUM] CWE-1333 @octokit/request-error: @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
@octokit/request-error: @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
@octokit/request-error is an error class for Octokit request errors. Starting in version 1.0.0 and prior to version 6.1.7, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the processing of HTTP request headers. By sending an authorization header containing an excessively long sequence of spaces followed by a newline and "@", an attacker can exploit inefficient regular expression processing, leading to excessive resource consumption. This can significantly degrade server performance or cause a denial-of-service (DoS) condition, impacting availability. Version 6.1.7 contains a fix for the issue.
A Regular Expression Denia
Microsoft
path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x
vendor_msrc·2024-12-10·CVSS 7.7
CVE-2024-52798 [HIGH] CWE-1333 path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x
path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https:
Microsoft
path-to-regexp outputs backtracking regular expressions
vendor_msrc·2024-09-10·CVSS 7.5
CVE-2024-45296 [HIGH] CWE-1333 path-to-regexp outputs backtracking regular expressions
path-to-regexp outputs backtracking regular expressions
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https:/
Microsoft
Regular-expression DoS when parsing TarFile headers
vendor_msrc·2024-09-10·CVSS 7.5
CVE-2024-6232 [HIGH] CWE-1333 Regular-expression DoS when parsing TarFile headers
Regular-expression DoS when parsing TarFile headers
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
PSF: PSF
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microso
Microsoft
Excessive time spent checking DH keys and parameters
vendor_msrc·2023-07-11·CVSS 5.3
CVE-2023-3446 [MEDIUM] CWE-1333 Excessive time spent checking DH keys and parameters
Excessive time spent checking DH keys and parameters
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
openssl: openssl
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://lear
Microsoft
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range when untrusted user data is provided as a range.
vendor_msrc·2023-06-13·CVSS 7.5
CVE-2022-25883 [MEDIUM] CWE-1333 Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range when untrusted user data is provided as a range.
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range when untrusted user data is provided as a range.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect th
Microsoft
A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expressio
vendor_msrc·2023-02-14·CVSS 7.5
CVE-2023-22795 [HIGH] CWE-1333 A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expressio
A regular expression based DoS vulnerability in Action Dispatch Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
hackerone: hackerone
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: htt
Microsoft
Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression
vendor_msrc·2022-12-13·CVSS 5.9
CVE-2022-40897 [MEDIUM] CWE-1333 Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression
Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additi
Microsoft
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
vendor_msrc·2022-10-11·CVSS 7.5
CVE-2022-37603 [HIGH] CWE-1333 A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect
Microsoft
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
vendor_msrc·2022-09-13·CVSS 7.5
CVE-2022-40023 [HIGH] CWE-1333 Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: M
Microsoft
In mistune through 2.0.2 support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named cata
vendor_msrc·2022-07-12·CVSS 7.5
CVE-2022-34749 [HIGH] CWE-1333 In mistune through 2.0.2 support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named cata
In mistune through 2.0.2 support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identifi
Microsoft
Regular Expression Denial of Service (ReDoS)
vendor_msrc·2022-07-12·CVSS 5.3
CVE-2022-25858 [MEDIUM] CWE-1333 Regular Expression Denial of Service (ReDoS)
Regular Expression Denial of Service (ReDoS)
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
snyk: snyk
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.co
Microsoft
Regular expression denial of service in Rust's regex crate
vendor_msrc·2022-03-08·CVSS 7.5
CVE-2022-24713 [HIGH] CWE-1333 Regular expression denial of service in Rust's regex crate
Regular expression denial of service in Rust's regex crate
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: http
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-05-01
Published