CWE-1333: Regular expression denial of service (ReDoS)

CVEs per yearBy the year they were published

1. 202259
2. 20223
3. 202365
4. 20234
5. 20233
6. 202468
7. 202416
8. 20256
9. 2026200
10. 202672
11. 202679

Newest CVEs

• CVE-2026-120645

  CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list

  CGI

  Not scored
• CVE-2026-120632

  CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type

  CGI

  Not scored
• CVE-2026-120631

  CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse

  CGI

  Not scored
• CVE-2026-121577

  Unescaped header separators in whatstk build a regular expression that backtracks exponentially

  lucasrodes · whatstk

  Medium6.7
• CVE-2026-120217

  Delgan loguru ANSI Color-Markup _colorizer.py AnsiParser.feed redos

  Delgan · loguru

  Medium5.3
• CVE-2026-62864

  Ring's nested-params middleware has inefficient regular expression complexity

  ring-clojure · ring

  High7.5
• CVE-2026-119300

  Wekan: ReDoS via Unescaped User Input in RegExp

  wekan · wekan

  Medium6.5
• CVE-2026-118993

  CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI

  CallBackery

  Not scored
• CVE-2026-115866

  Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies

  Starlet

  Not scored
• CVE-2026-119202

  @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

  hapijs · content

  High7.5

Vendors it comes up for most

1. GitLab37
2. Apache Software Foundation10
3. huggingface10
4. hapijs6
5. lepture6
6. rails6
7. Red Hat5
8. facelessuser5
9. lunary-ai5
10. nltk5