path-to-regexp outputs backtracking regular expressions
cve-program · CVE-2024-45296
Publishedpath-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.
Read the publisher's advisorycve-program · CVE-2026-4867
PublishedImpact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking. Patches: Upgrade to [email protected] Custom regex patterns in route definitions (e.g., /:a-:b([^-/]+)-:c([^-/]+)) are not affected because they override the default capture group. Workarounds: All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+). If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length.
Read the publisher's advisoryeuvd · EUVD-2024-2764
Publishedpath-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.
Read the publisher's advisoryeuvd · EUVD-2026-16273
PublishedImpact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking. Patches: Upgrade to [email protected] Custom regex patterns in route definitions (e.g., /:a-:b([^-/]+)-:c([^-/]+)) are not affected because they override the default capture group. Workarounds: All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+). If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length.
Read the publisher's advisorynvd · CVE-2024-45296
Publishedpath-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.
Read the publisher's advisorynvd · CVE-2026-4867
PublishedImpact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking. Patches: Upgrade to [email protected] Custom regex patterns in route definitions (e.g., /:a-:b([^-/]+)-:c([^-/]+)) are not affected because they override the default capture group. Workarounds: All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+). If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length.
Read the publisher's advisoryosv · GHSA-37ch-88jc-xwx2
Published### Impact A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (`.`). For example, `/:a-:b-:c` or `/:a-:b-:c-:d`. The backtrack protection added in `[email protected]` only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking. ### Patches Upgrade to [[email protected]](https://github.com/pillarjs/path-to-regexp/releases/tag/v.0.1.13) Custom regex patterns in route definitions (e.g., `/:a-:b([^-/]+)-:c([^-/]+)`) are not affected because they override the default capture group. ### Workarounds All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change `/:a-:b-:c` to `/:a-:b([^-/]+)-:c([^-/]+)`. If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length. ### References - [GHSA-9wv6-86v2-598j](https://github.com/advisories/GHSA-9wv6-86v2-598j) - [Detailed blog post: ReDoS the web](https://blakeembrey.com/posts/2024-09-web-redos/)
Read the publisher's advisoryosv · GHSA-9wv6-86v2-598j
Published### Impact A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (`.`). For example, `/:a-:b`. ### Patches For users of 0.1, upgrade to `0.1.10`. All other users should upgrade to `8.0.0`. These versions add backtrack protection when a custom regex pattern is not provided: - [0.1.10](https://github.com/pillarjs/path-to-regexp/releases/tag/v0.1.10) - [1.9.0](https://github.com/pillarjs/path-to-regexp/releases/tag/v1.9.0) - [3.3.0](https://github.com/pillarjs/path-to-regexp/releases/tag/v3.3.0) - [6.3.0](https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0) They do not protect against vulnerable user supplied capture groups. Protecting against explicit user patterns is out of scope for old versions and not considered a vulnerability. Version [7.1.0](https://github.com/pillarjs/path-to-regexp/releases/tag/v7.1.0) can enable `strict: true` and get an error when the regular expression might be bad. Version [8.0.0](https://github.com/pillarjs/path-to-regexp/releases/tag/v8.0.0) removes the features that can cause a ReDoS. ### Workarounds All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change `/:a-:b` to `/:a-:b([^-/]+)`. If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length. For example, halving the attack string improves performance by 4x faster. ### Details Using `/:a-:b` will produce the regular expression `/^\/([^\/]+?)-([^\/]+?)\/?$/`. This can be exploited by a path such as `/a${'-a'.repeat(8_000)}/a`. [OWASP](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) has a good example of why this occurs, but the TL;DR is the `/a` at the end ensures this route would never match but due to naive backtracking it will still attempt every combination of the `:a-:b` on the repeated 8,000 `-a`. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and can lead to a DoS. In local benchmarks, exploiting the unsafe regex will result in performance that is over 1000x worse than the safe regex. In a more realistic environment using Express v4 and 10 concurrent connections, this translated to average latency of ~600ms vs 1ms. ### References * [OWASP](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) * [Detailed blog post](https://blakeembrey.com/posts/2024-09-web-redos/)
Read the publisher's advisoryAffected versions, risk and source history
Exploitation and risk
Source statusCISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.
Which CVEs have scores here?
This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.
No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.
cve-program · CVE-2024-45296
Publishedpath-to-regexp outputs backtracking regular expressions
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.
- Source published
- 9 Sep 2024 19:07:40 UTC
- Source modified
- 24 Jan 2025 20:03:07 UTC
- Saved here
- 23 Oct 2026 15:48:27 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve-program · CVE-2026-4867
Publishedpath-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters
Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking. Patches: Upgrade to [email protected] Custom regex patterns in route definitions (e.g., /:a-:b([^-/]+)-:c([^-/]+)) are not affected because they override the default capture group. Workarounds: All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+). If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length.
- Source published
- 26 Mar 2026 16:16:25 UTC
- Source modified
- 26 Mar 2026 16:52:14 UTC
- Saved here
- 23 Oct 2026 15:48:27 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
euvd · EUVD-2024-2764
Publishedpath-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs o…
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.
Additional publisher context
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
Original publisher date fields
datePublished: Sep 9, 2024, 7:07:40 PM
dateUpdated: Jan 24, 2025, 8:03:07 PM
45 related source bulletins · separate from aliases
RHSA-2024:7726: Red Hat Security Advisory: Red Hat OpenShift Service Mesh Containers for 2.6.2
CVE-2024-7264 · CVE-2024-43788 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-45590 · CVE-2024-45806 · CVE-2024-45808 · CVE-2024-45810
RHSA-2024:10857: Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.7.2 security updates and bug fixes
CVE-2023-47108 · CVE-2024-45296 · CVE-2024-45813
openSUSE-SU-2024:14374-1: argocd-cli-2.12.4-1.1 on GA media
CVE-2024-45296
RHSA-2024:7599: Red Hat Security Advisory: OpenShift Container Platform 4.16.16 bug fix and security update
CVE-2023-3462 · CVE-2024-2961 · CVE-2024-6119 · CVE-2024-45296 · CVE-2024-45490 · CVE-2024-45491 · CVE-2024-45492
RHSA-2024:7922: Red Hat Security Advisory: OpenShift Container Platform 4.17.1 bug fix and security update
CVE-2023-3462 · CVE-2023-45290 · CVE-2024-3727 · CVE-2024-6345 · CVE-2024-6508 · CVE-2024-24786 · CVE-2024-24791 · CVE-2024-27289 · CVE-2024-45296
RHSA-2024:9885: Red Hat Security Advisory: Red Hat Trusted Profile Analyzer 1.2.0
CVE-2024-45296 · CVE-2024-45590
WID-SEC-W-2024-3733: Red Hat Advanced Cluster Management: Mehrere Schwachstellen
CVE-2024-45296 · CVE-2024-45813 · CVE-2024-45801
RHSA-2024:8581: Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps v1.13.2 security update
CVE-2023-26115 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-45590
WID-SEC-W-2025-0580: IBM License Metric Tool: Mehrere Schwachstellen
CVE-2024-10917 · CVE-2024-12797 · CVE-2024-21208 · CVE-2024-21210 · CVE-2024-21217 · CVE-2024-21235 · CVE-2024-45296 · CVE-2024-52798 · CVE-2024-57965 · CVE-2025-27111 · CVE-2025-27152 · CVE-2025-25184
RHSA-2025:0875: Red Hat Security Advisory: OpenShift Container Platform 4.17.15 security and extras update
CVE-2024-21538 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-45338 · CVE-2024-45590 · CVE-2024-48910 · CVE-2024-52798 · CVE-2024-55565 · CVE-2024-56201 · CVE-2024-56326
RHSA-2024:7324: Red Hat Security Advisory: Logging for Red Hat OpenShift - 5.9.7
CVE-2024-6104 · CVE-2024-45296 · CVE-2024-45801
WID-SEC-W-2024-3542: Red Hat OpenShift: Mehrere Schwachstellen
CVE-2023-42282 · CVE-2024-29415 · CVE-2024-21534 · CVE-2024-34156 · CVE-2024-45296 · CVE-2024-45813 · CVE-2024-47875 · CVE-2024-48949
RHSA-2024:9884: Red Hat Security Advisory: Red Hat Trusted Profile Analyzer 1.2.0
CVE-2024-45296 · CVE-2024-45590
WID-SEC-W-2024-3344: HCL BigFix WebUI: Mehrere Open Source Schwachstellen
CVE-2023-26159 · CVE-2023-45857 · CVE-2024-21501 · CVE-2024-33883 · CVE-2024-35255 · CVE-2024-38996 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-45590 · CVE-2024-8372 · CVE-2024-8373
WID-SEC-W-2025-0043: IBM QRadar SIEM (Log Source Management App): Mehrere Schwachstellen
CVE-2024-43788 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-47068 · CVE-2024-47875 · CVE-2024-21536 · CVE-2024-21538 · CVE-2024-33883 · CVE-2024-37890 · CVE-2024-4067 · CVE-2024-4068 · CVE-2024-45296 · CVE-2024-45590 · CVE-2024-48948 · CVE-2024-48949 · CVE-2024-52798 · CVE-2024-55565 · CVE-2024-45801 · CVE-2024-42459 · CVE-2024-42460 · CVE-2024-42461 · CVE-2024-47764
RHSA-2024:11293: Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.6.4 security enhancements and bug fixes
CVE-2023-47108 · CVE-2024-45296 · CVE-2024-45813
RHSA-2024:10962: Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Jaeger) 3.4 release
CVE-2024-21536 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-45590 · CVE-2024-45811 · CVE-2024-45812 · CVE-2024-47068
msrc_CVE-2024-45296: path-to-regexp outputs backtracking regular expressions
CVE-2024-45296
WID-SEC-W-2024-3534: Red Hat Trusted Profile Analyzer: Mehrere Schwachstellen ermöglichen Denial of Service
CVE-2024-45296 · CVE-2024-45590
RHSA-2024:10865: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.12.1 bug fixes and container updates
CVE-2024-45296 · CVE-2024-45813
RHSA-2025:3397: Red Hat Security Advisory: RHOAI 2.16.0 - Red Hat OpenShift AI
CVE-2024-21538 · CVE-2024-45296 · CVE-2024-45338 · CVE-2024-45339 · CVE-2024-52798 · CVE-2024-55565 · CVE-2024-56171 · CVE-2024-56201 · CVE-2025-22150 · CVE-2025-24928 · CVE-2025-26791
RHBA-2024:11265: Red Hat Bug Fix Advisory: Red Hat Developer Hub 1.4.0 release.
CVE-2024-21536 · CVE-2024-21538 · CVE-2024-45296 · CVE-2024-45590 · CVE-2024-45815 · CVE-2024-45816 · CVE-2024-46976 · CVE-2024-47762
RHBA-2024:11558: Red Hat Bug Fix Advisory: Red Hat Quay v3.11.7 bug fix release
CVE-2024-39338 · CVE-2024-45296
WID-SEC-W-2024-3250: Red Hat OpenShift: Mehrere Schwachstellen
CVE-2024-34155 · CVE-2024-34156 · CVE-2024-34158 · CVE-2024-39338 · CVE-2024-43788 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-45590 · CVE-2024-45801
RHSA-2025:0082: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.16.5 Bug Fix Update
CVE-2023-26136 · CVE-2023-26364 · CVE-2024-21538 · CVE-2024-24791 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-48910 · CVE-2024-55565
RHSA-2024:10917: Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Jaeger) 3.4 release
CVE-2024-21536 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-45590 · CVE-2024-45811 · CVE-2024-45812 · CVE-2024-47068
RHSA-2024:8014: Red Hat Security Advisory: Network Observability 1.7.0 for OpenShift
CVE-2024-34155 · CVE-2024-34156 · CVE-2024-34158 · CVE-2024-39338 · CVE-2024-43788 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-45590 · CVE-2024-45801
WID-SEC-W-2026-0177: Atlassian Bamboo, Bitbucket, Confluence und Jira: Mehrere Schwachstellen
CVE-2021-3807 · CVE-2022-25883 · CVE-2022-45693 · CVE-2024-21538 · CVE-2024-38286 · CVE-2024-45296 · CVE-2024-45801 · CVE-2025-12383 · CVE-2025-15284 · CVE-2025-27152 · CVE-2025-41249 · CVE-2025-48976 · CVE-2025-48989 · CVE-2025-49146 · CVE-2025-52434 · CVE-2025-52999 · CVE-2025-53689 · CVE-2025-54988 · CVE-2025-55163 · CVE-2025-55752 · CVE-2025-64775 · CVE-2025-66516 · CVE-2025-9287 · CVE-2025-9288 · CVE-2026-21569
RHSA-2024:10762: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
CVE-2024-8775 · CVE-2024-9902 · CVE-2024-45296 · CVE-2024-45801
RHSA-2024:8676: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.17.0 Security, Enhancement, & Bug Fix Update
CVE-2023-26136 · CVE-2023-26364 · CVE-2024-24786 · CVE-2024-24789 · CVE-2024-28176 · CVE-2024-41818 · CVE-2024-43788 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-45590
RHSA-2025:0323: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.14.13 Bug Fix Update
CVE-2023-26136 · CVE-2023-26364 · CVE-2024-43788 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296
WID-SEC-W-2025-0001: IBM DB2: Mehrere Schwachstellen
CVE-2021-32740 · CVE-2021-41186 · CVE-2022-0759 · CVE-2022-24795 · CVE-2022-31163 · CVE-2023-39325 · CVE-2023-41993 · CVE-2023-45283 · CVE-2023-45288 · CVE-2023-6597 · CVE-2024-0406 · CVE-2024-20918 · CVE-2024-20952 · CVE-2024-2398 · CVE-2024-24786 · CVE-2024-27281 · CVE-2024-2961 · CVE-2024-29857 · CVE-2024-33599 · CVE-2024-33883 · CVE-2024-37370 · CVE-2024-37371 · CVE-2024-37890 · CVE-2024-39338 · CVE-2024-4068 · CVE-2024-41110 · CVE-2024-41123 · CVE-2024-41946 · CVE-2024-45296 · CVE-2024-45491 · CVE-2024-45590 · CVE-2024-47220 · CVE-2024-47554 · CVE-2024-6119 · CVE-2024-6345
RHSA-2024:11381: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.11.4 security enhancements and bug fixes
CVE-2024-45296 · CVE-2024-45801 · CVE-2024-45813
RHSA-2025:1249: Red Hat Security Advisory: updated discovery container images
CVE-2020-11023 · CVE-2023-44270 · CVE-2024-6485 · CVE-2024-8775 · CVE-2024-21536 · CVE-2024-21538 · CVE-2024-31228 · CVE-2024-31449 · CVE-2024-39338 · CVE-2024-41989 · CVE-2024-41991 · CVE-2024-42005 · CVE-2024-43788 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-45590 · CVE-2024-46981 · CVE-2024-52798 · CVE-2024-53907 · CVE-2024-55565 · CVE-2024-56201 · CVE-2024-56326 · CVE-2024-56374
RHSA-2024:10236: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.17.0 release
CVE-2023-42282 · CVE-2024-21534 · CVE-2024-29415 · CVE-2024-34155 · CVE-2024-34156 · CVE-2024-45296 · CVE-2024-45813 · CVE-2024-47875 · CVE-2024-48949
WID-SEC-W-2024-3211: IBM App Connect Enterprise: Schwachstelle ermöglicht Denial of Service
CVE-2024-45296
NCSC-2026-0034: Kwetsbaarheden verholpen in Atlassian producten
CVE-2021-3807 · CVE-2022-25883 · CVE-2022-45693 · CVE-2024-21538 · CVE-2024-38286 · CVE-2024-45296 · CVE-2024-45801 · CVE-2025-12383 · CVE-2025-15284 · CVE-2025-27152 · CVE-2025-41249 · CVE-2025-48976 · CVE-2025-48989 · CVE-2025-49146 · CVE-2025-52434 · CVE-2025-52999 · CVE-2025-53689 · CVE-2025-54988 · CVE-2025-55163 · CVE-2025-55752 · CVE-2025-64775 · CVE-2025-66516 · CVE-2025-9287 · CVE-2025-9288 · CVE-2026-21569
RHSA-2024:10906: Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.8.5 security and bug fix update
CVE-2024-24790 · CVE-2024-24791 · CVE-2024-34155 · CVE-2024-34156 · CVE-2024-34158 · CVE-2024-43788 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-45590
RHSA-2024:6122: Red Hat Security Advisory: OpenShift Container Platform 4.18.1 bug fix and security update
CVE-2023-44270 · CVE-2023-45288 · CVE-2024-3727 · CVE-2024-6104 · CVE-2024-6508 · CVE-2024-7387 · CVE-2024-9341 · CVE-2024-10963 · CVE-2024-12085 · CVE-2024-12698 · CVE-2024-21538 · CVE-2024-24786 · CVE-2024-39338 · CVE-2024-43803 · CVE-2024-45296 · CVE-2024-45338 · CVE-2024-45496 · CVE-2024-47211 · CVE-2024-48910 · CVE-2024-50311 · CVE-2024-50312 · CVE-2024-52798 · CVE-2024-53104 · CVE-2025-21613 · CVE-2025-21614
RHSA-2025:0164: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.15.9 Bug Fix Update
CVE-2023-26136 · CVE-2023-26364 · CVE-2024-21538 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296
WID-SEC-W-2024-3674: Splunk Splunk Enterprise: Mehrere Schwachstellen
CVE-2021-44531 · CVE-2024-25710 · CVE-2024-26308 · CVE-2024-36114 · CVE-2024-36129 · CVE-2024-4067 · CVE-2024-42459 · CVE-2024-42460 · CVE-2024-42461 · CVE-2024-45296 · CVE-2024-5535 · CVE-2024-6531 · CVE-2024-53243 · CVE-2024-53244 · CVE-2024-53245 · CVE-2024-53246 · CVE-2024-53247
RHSA-2025:0664: Red Hat Security Advisory: Release of OpenShift Serverless Logic 1.35.0 security update & enhancements
CVE-2024-24786 · CVE-2024-40094 · CVE-2024-45296
openSUSE-SU-2025:14663-1: velociraptor-0.7.0.4.git142.862ef23-1.1 on GA media
CVE-2023-1732 · CVE-2023-44270 · CVE-2023-45133 · CVE-2023-45683 · CVE-2023-46234 · CVE-2024-21538 · CVE-2024-23331 · CVE-2024-24786 · CVE-2024-28180 · CVE-2024-31207 · CVE-2024-37298 · CVE-2024-4067 · CVE-2024-4068 · CVE-2024-42459 · CVE-2024-42460 · CVE-2024-42461 · CVE-2024-45296 · CVE-2024-45338 · CVE-2024-45811 · CVE-2024-45812 · CVE-2024-47068 · CVE-2024-47875 · CVE-2024-48948 · CVE-2024-48949 · CVE-2024-51744 · CVE-2024-55565 · CVE-2024-6104
RHSA-2024:11023: Red Hat Security Advisory: HawtIO 4.1.0 for Red Hat build of Apache Camel 4 Release and security update.
CVE-2024-2700 · CVE-2024-4068 · CVE-2024-7885 · CVE-2024-8184 · CVE-2024-38816 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296
RHSA-2025:3368: Red Hat Security Advisory: RHOAI 2.16.0 - Red Hat OpenShift AI
CVE-2024-21538 · CVE-2024-45296 · CVE-2024-45338 · CVE-2024-45339 · CVE-2024-52798 · CVE-2024-55565 · CVE-2024-56171 · CVE-2024-56201 · CVE-2025-22150 · CVE-2025-24928 · CVE-2025-26791
- Source published
- Sep 9, 2024, 7:07:40 PM (timezone not stated)
- Source modified
- Jan 24, 2025, 8:03:07 PM (timezone not stated)
- Saved here
- 15 Nov 2026 04:39:01 UTC
- Source terms
- ENISA EUVD · source terms and attribution apply
Original source record · Cite this exact observation · Complete original publisher JSON
Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
EUVD CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
euvd · EUVD-2026-16273
PublishedImpact:
Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking. Patches: Upgrade to [email protected] Custom regex patterns in route definitions (e.g., /:a-:b([^-/]+)-:c([^-/]+)) are not affected because they override the default capture group. Workarounds: All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+). If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length.
Additional publisher context
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
Original publisher date fields
datePublished: Mar 26, 2026, 4:16:25 PM
dateUpdated: Mar 26, 2026, 4:52:14 PM
1 related source bulletins · separate from aliases
RHSA-2026:34342: Red Hat Security Advisory: Cluster Observability Operator 1.5.0
CVE-2020-7753 · CVE-2021-33623 · CVE-2024-4068 · CVE-2024-45338 · CVE-2024-52011 · CVE-2025-22868 · CVE-2025-22870 · CVE-2025-22872 · CVE-2025-47911 · CVE-2025-58190 · CVE-2026-1526 · CVE-2026-1528 · CVE-2026-2229 · CVE-2026-4800 · CVE-2026-4867 · CVE-2026-6321 · CVE-2026-6322 · CVE-2026-6734 · CVE-2026-9277 · CVE-2026-9697 · CVE-2026-12143 · CVE-2026-12151 · CVE-2026-25680 · CVE-2026-25681 · CVE-2026-29063 · CVE-2026-32141 · CVE-2026-33228 · CVE-2026-33671 · CVE-2026-33814 · CVE-2026-33891 · CVE-2026-33894 · CVE-2026-33895 · CVE-2026-33896 · CVE-2026-33937 · CVE-2026-33938 · CVE-2026-33939 · CVE-2026-33940 · CVE-2026-33941 · CVE-2026-39821 · CVE-2026-42506 · CVE-2026-48779
- Source published
- Mar 26, 2026, 4:16:25 PM (timezone not stated)
- Source modified
- Mar 26, 2026, 4:52:14 PM (timezone not stated)
- Saved here
- 15 Nov 2026 14:08:12 UTC
- Source terms
- ENISA EUVD · source terms and attribution apply
Original source record · Cite this exact observation · Complete original publisher JSON
Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
EUVD CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd · CVE-2024-45296
Publishedpath-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs o…
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.
Additional publisher context
NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Deferred
Weakness classifications: CWE-1333
Original publisher date fields
published: 2024-09-09T19:15:13.330
lastModified: 2026-06-17T07:53:58.263
- Source published
- 9 Sep 2024 19:15:13 UTC
- Source modified
- 17 Jun 2026 07:53:58 UTC
- Saved here
- 25 Oct 2026 00:17:28 UTC
- Source terms
- NIST NVD usage terms; underlying source attribution retained
Original source record · Cite this exact observation · Complete original publisher JSON
Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · [email protected] · Secondary · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd · CVE-2026-4867
PublishedImpact:
Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking. Patches: Upgrade to [email protected] Custom regex patterns in route definitions (e.g., /:a-:b([^-/]+)-:c([^-/]+)) are not affected because they override the default capture group. Workarounds: All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+). If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length.
Additional publisher context
NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Analyzed
Weakness classifications: CWE-1333
Original publisher date fields
published: 2026-03-26T17:16:42.983
lastModified: 2026-06-17T10:57:21.827
1 source CPE criteria · context only
- cpe:2.3:a:pillarjs:path-to-regexp:*:*:*:*:*:node.js:*:*
The original JSON retains the logical configuration operators, exclusions and version bounds.
- Source published
- 26 Mar 2026 17:16:42 UTC
- Source modified
- 17 Jun 2026 10:57:21 UTC
- Saved here
- 25 Oct 2026 12:17:32 UTC
- Source terms
- NIST NVD usage terms; underlying source attribution retained
Original source record · Cite this exact observation · Complete original publisher JSON
Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv · GHSA-37ch-88jc-xwx2
Publishedpath-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters
### Impact A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (`.`). For example, `/:a-:b-:c` or `/:a-:b-:c-:d`. The backtrack protection added in `[email protected]` only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking. ### Patches Upgrade to [[email protected]](https://github.com/pillarjs/path-to-regexp/releases/tag/v.0.1.13) Custom regex patterns in route definitions (e.g., `/:a-:b([^-/]+)-:c([^-/]+)`) are not affected because they override the default capture group. ### Workarounds All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change `/:a-:b-:c` to `/:a-:b([^-/]+)-:c([^-/]+)`. If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length. ### References - [GHSA-9wv6-86v2-598j](https://github.com/advisories/GHSA-9wv6-86v2-598j) - [Detailed blog post: ReDoS the web](https://blakeembrey.com/posts/2024-09-web-redos/)
- Source published
- 27 Mar 2026 20:04:53 UTC
- Source modified
- 10 Sep 2026 03:50:36 UTC
- Saved here
- 24 Oct 2026 13:17:17 UTC
- Source terms
- GitHub Advisory Database · CC-BY-4.0
Original source record · Cite this exact observation · Complete original publisher JSON
Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Publisher rating · HIGH
osv · GHSA-9wv6-86v2-598j
Publishedpath-to-regexp outputs backtracking regular expressions
### Impact A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (`.`). For example, `/:a-:b`. ### Patches For users of 0.1, upgrade to `0.1.10`. All other users should upgrade to `8.0.0`. These versions add backtrack protection when a custom regex pattern is not provided: - [0.1.10](https://github.com/pillarjs/path-to-regexp/releases/tag/v0.1.10) - [1.9.0](https://github.com/pillarjs/path-to-regexp/releases/tag/v1.9.0) - [3.3.0](https://github.com/pillarjs/path-to-regexp/releases/tag/v3.3.0) - [6.3.0](https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0) They do not protect against vulnerable user supplied capture groups. Protecting against explicit user patterns is out of scope for old versions and not considered a vulnerability. Version [7.1.0](https://github.com/pillarjs/path-to-regexp/releases/tag/v7.1.0) can enable `strict: true` and get an error when the regular expression might be bad. Version [8.0.0](https://github.com/pillarjs/path-to-regexp/releases/tag/v8.0.0) removes the features that can cause a ReDoS. ### Workarounds All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change `/:a-:b` to `/:a-:b([^-/]+)`. If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length. For example, halving the attack string improves performance by 4x faster. ### Details Using `/:a-:b` will produce the regular expression `/^\/([^\/]+?)-([^\/]+?)\/?$/`. This can be exploited by a path such as `/a${'-a'.repeat(8_000)}/a`. [OWASP](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) has a good example of why this occurs, but the TL;DR is the `/a` at the end ensures this route would never match but due to naive backtracking it will still attempt every combination of the `:a-:b` on the repeated 8,000 `-a`. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and can lead to a DoS. In local benchmarks, exploiting the unsafe regex will result in performance that is over 1000x worse than the safe regex. In a more realistic environment using Express v4 and 10 concurrent connections, this translated to average latency of ~600ms vs 1ms. ### References * [OWASP](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) * [Detailed blog post](https://blakeembrey.com/posts/2024-09-web-redos/)
- Source published
- 9 Sep 2024 20:19:15 UTC
- Source modified
- 10 Sep 2026 03:50:18 UTC
- Saved here
- 24 Oct 2026 13:17:17 UTC
- Source terms
- GitHub Advisory Database · CC-BY-4.0
Original source record · Cite this exact observation · Complete original publisher JSON
Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Publisher rating · HIGH