Executable Regular Expression Error

The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.

CVEs (4)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-113877 - - Oct 23, 2026 Oct 23, 2026 N/A· v4 N/A· v3 N/A· v2 HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. _language_match interpolates each Accept-Language range into the pattern `/^$range\...Show more HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. _language_match interpolates each Accept-Language range into the pattern `/^$range\-/i` without escaping it, so regular expression syntax in the header reaches the regex engine. A 12-byte range such as `(a?\|b?){26}z` backtracks for seconds, and each increment of the quantifier doubles the time. An invalid range such as `(` fails to compile. A remote attacker can exhaust CPU, or make choose_language die, in any application that passes an untrusted Accept-Language header to it.Show less
CVE-2026-97076 - - Oct 11, 2026 Oct 9, 2026 N/A· v4 7.5 HIGH· v3 N/A· v2 Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5.
CVE-2026-25237 1Pear 1Pearweb Jun 17, 2026 Feb 3, 2026 9.2 CRITICAL· v4 9.8 CRITICAL· v3 N/A· v2 PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, use of preg_replace() with the /e modifier in bug update email handling can enable PHP code execution if attacker-controll...Show more PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, use of preg_replace() with the /e modifier in bug update email handling can enable PHP code execution if attacker-controlled content reaches the evaluated replacement. This issue has been patched in version 1.33.0.Show less
CVE-2024-41655 - - Jun 17, 2026 Jul 23, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 TF2 Item Format helps users format TF2 items to the community standards. Versions of `tf2-item-format` since at least `4.2.6` and prior to `5.9.14` are vulnerable to a Regular Expression Denial of Service (ReDoS) attack...Show more TF2 Item Format helps users format TF2 items to the community standards. Versions of `tf2-item-format` since at least `4.2.6` and prior to `5.9.14` are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when parsing crafted user input. This vulnerability can be exploited by an attacker to perform DoS attacks on any service that uses any `tf2-item-format` to parse user input. Version `5.9.14` contains a fix for the issue.Show less