HTTP::Headers::ActionPack before 0.10 can exhaust CPU (CVE-2026-113877)
Accept-Language ranges are matched as regular expressions, which can burn CPU on crafted input.
Stories per day · 30 days
1 RSS
Relatedgitlab3remote-code-execution2accept-language1ci-cd1cve-2026-972291denial-of-service1http-headers-actionpack1integer-overflow1onigmo1patch1perl1rce1ruby1self-managed1xss1
13 stories, newest first · one card per story
Stories tagged #regex
Ruby fixes three regex bugs behind four critical GitLab RCE flaws
Apps that compile attacker-controlled patterns are affected; GitLab’s unauthenticated CVE-2026-110264 covers versions from 7.0 and is not in KEV.
GitLab patches unauthenticated RCE in CE and EE (CVE-2026-110264)
The integer overflow reaches GitLab 7.0 from June 2014; no in-the-wild exploitation is indicated yet.
2
GitLab patches a max-severity regex flaw alongside five high-severity bugs
GitLab patched unauthenticated CI/CD regex RCE CVE-2026-97229 (CVSS 10) and five high-severity flaws.
3
GitLab warns of max severity code execution vulnerability
GitLab patched maximum-severity unauthenticated RCE CVE-2026-97229 in its CI/CD regex compiler.
4
Critical GitLab Bugs Let Attackers Execute Code Through Malicious CI/CD Regex
GitLab patched two CVSS 9.9 flaws letting authenticated users execute code via malicious CI/CD regular expressions.
USN-8736-2: Perl vulnerabilities
Ubuntu issued USN-8736-2 fixing two Perl regex flaws that could cause out-of-bounds heap access, denial of service, or security bypass on 24.04 LTS.
Re: pcre2 version 10.48 released with security fixes
PCRE2 10.48 released with security fixes; seven vulnerabilities assigned CVEs including CVE-2026-86145 and CVE-2026-89156 through CVE-2026-89162.
CVE-2026-82617: Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns
Apache OpenNLP CVE-2026-82617: built-in EMAIL and URL regex name-finder patterns enable regular expression denial-of-service and stack exhaustion in affected releases.
An Empirical Analysis of ReDoS Vulnerabilities and ReDoS Detection Tools
Study of NVD data finds ReDoS vulnerabilities growing more prevalent and more likely to be exploited, while five detection tools disagree substantially.
USN-8675-2: Perl vulnerabilities
Ubuntu issued USN-8675-2 fixing two Perl flaws (CVE-2026-12087, CVE-2026-13221) enabling information disclosure and regex-based security bypass on 26.04 LTS.
USN-8736-1: Perl vulnerabilities
Ubuntu issued USN-8736-1 fixing two Perl regex flaws that could cause denial of service, code execution, or security-restriction bypass.
pcre2 version 10.48 released with security fixes
PCRE2 10.48 released with security fixes; none have CVE IDs assigned yet, details limited to release notes.