https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T18:37:47.475166+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2022:1287 ALSA-2022:1287 — Important: firefox security update 2026-10-02T18:37:48.092344+00:00

Affected: AlmaLinux:8: firefox

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 91.8.0 ESR.

Security Fix(es):

* Mozilla: Use-after-free in NSSToken objects (CVE-2022-1097)

* Mozilla: Out of bounds write due to unexpected WebAuthN Extensions (CVE-2022-28281)

* Mozilla: Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8 (CVE-2022-28289)

* Mozilla: Use-after-free after VR Process destruction (CVE-2022-1196)

* Mozilla: Use-after-free in DocumentL10n::TranslateDocument (CVE-2022-28282)

* Mozilla: Incorrect AliasSet used in JIT Codegen (CVE-2022-28285)

* Mozilla: Denial of Service via complex regular expressions (CVE-2022-24713)

* Mozilla: iframe contents could be rendered outside the border (CVE-2022-28286)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2022-02373 bdu:2022-02373 2026-10-02T18:37:48.092424+00:00 bdu:2022-02373 https://cve.radiocsirt.org/vuln/certfr-2022-avi-311 certfr-2022-avi-311 — De multiples vulnérabilités ont été découvertes dans Mozilla Firefox et Firefox ESR. Certaines d'entre elles permettent… 2026-10-02T18:37:48.092441+00:00 certfr-2022-avi-311 https://cve.radiocsirt.org/vuln/cleanstart-2024-ag66831 CLEANSTART-2024-AG66831 — regex is an implementation of regular expressions for the Rust language 2026-10-02T18:37:48.092457+00:00

Affected: CleanStart: bat, CleanStart: delta

CVE-2022-24713 affects multiple packages. regex is an implementation of regular expressions for the Rust language. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-234383 EUVD-2026-234383 2026-10-02T18:37:48.092481+00:00 EUVD-2026-234383 https://cve.radiocsirt.org/vuln/fkie_cve-2022-24713 fkie_cve-2022-24713 2026-10-02T18:37:48.092492+00:00

regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This guarantee is documented and it's considered part of the crate's API. Unfortunately a bug was discovered in the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing, and it's possible to craft regexes that bypass such mitigations. This makes it possible to perform denial of service attacks by sending specially crafted regexes to services accepting user-controlled, untrusted regexes. All versions of the regex crate before or equal to 1.5.4 are affected by this issue. The fix is include starting from regex 1.5.5. All users accepting user-controlled regexes are recommended to upgrade immediately to the latest version of the regex crate. Unfortunately there is no fixed set of problematic regexes, as there are practically infinite regexes that could be crafted to exploit this vulnerability. Because of this, it us not recommend to deny known problematic regexes.

 https://cve.radiocsirt.org/vuln/ghsa-m5pq-gvj9-9vr8 GHSA-m5pq-gvj9-9vr8 — Rust's regex crate vulnerable to regular expression denial of service 2026-10-02T18:37:48.092521+00:00

Affected: crates.io: regex

> This is a cross-post of [the official security advisory][advisory]. The official advisory contains a signed version with our PGP key, as well.

[advisory]: https://groups.google.com/g/rustlang-security-announcements/c/NcNNL1Jq7Yw

The Rust Security Response WG was notified that the `regex` crate did not properly limit the complexity of the regular expressions (regex) it parses. An attacker could use this security issue to perform a denial of service, by sending a specially crafted regex to a service accepting untrusted regexes. No known vulnerability is present when parsing untrusted input with trusted regexes.

This issue has been assigned CVE-2022-24713. The severity of this vulnerability is "high" when the `regex` crate is used to parse untrusted regexes. Other uses of the `regex` crate are not affected by this vulnerability.

## Overview

The `regex` crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This guarantee is documented and it's considered part of the crate's API.

Unfortunately a bug was discovered in the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing, and it's possible to craft regexes that bypass such mitigations. This makes it possible to perform denial of service attacks by sending specially crafted regexes to services accepting…

 https://cve.radiocsirt.org/vuln/gsd-2022-24713 gsd-2022-24713 2026-10-02T18:37:48.092563+00:00 gsd-2022-24713 https://cve.radiocsirt.org/vuln/msrc_cve-2022-24713 msrc_CVE-2022-24713 — Regular expression denial of service in Rust's regex crate 2026-10-02T18:37:48.092576+00:00 msrc_CVE-2022-24713 https://cve.radiocsirt.org/vuln/oesa-2023-1673 OESA-2023-1673 — firefox security update 2026-10-02T18:37:48.092592+00:00

Affected: openEuler:22.03-LTS: firefox

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. Security Fix(es): Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 80, Firefox ESR < 78.2, Thunderbird < 78.2, and Firefox for Android < 80.(CVE-2020-15670) Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.(CVE-2020-15673) Mozilla developers reported memory safety bugs present in Firefox 80. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 81.(CVE-2020-15674) When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash. This vulnerability affects F…

 https://cve.radiocsirt.org/vuln/opensuse-su-2022:1127-1 openSUSE-SU-2022:1127-1 — Security update for MozillaFirefox 2026-10-02T18:37:48.093010+00:00

Security update for MozillaFirefox

 https://cve.radiocsirt.org/vuln/rhsa-2022:1283 RHSA-2022:1283 — Red Hat Security Advisory: firefox security update 2026-10-02T18:37:48.093031+00:00

Mozilla: Use-after-free in NSSToken objects Mozilla: Use-after-free after VR Process destruction Mozilla: Denial of Service via complex regular expressions Mozilla: Out of bounds write due to unexpected WebAuthN Extensions Mozilla: Use-after-free in DocumentL10n::TranslateDocument Mozilla: Incorrect AliasSet used in JIT Codegen Mozilla: iframe contents could be rendered outside the border Mozilla: Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8

 https://cve.radiocsirt.org/vuln/rustsec-2022-0013 RUSTSEC-2022-0013 — Regexes with large repetitions on empty sub-expressions take a very long time to parse 2026-10-02T18:37:48.093055+00:00

Affected: crates.io: regex

The Rust Security Response WG was notified that the `regex` crate did not properly limit the complexity of the regular expressions (regex) it parses. An attacker could use this security issue to perform a denial of service, by sending a specially crafted regex to a service accepting untrusted regexes. No known vulnerability is present when parsing untrusted input with trusted regexes.

This issue has been assigned CVE-2022-24713. The severity of this vulnerability is "high" when the `regex` crate is used to parse untrusted regexes. Other uses of the `regex` crate are not affected by this vulnerability.

## Overview

The `regex` crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This guarantee is documented and it's considered part of the crate's API.

Unfortunately a bug was discovered in the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing, and it's possible to craft regexes that bypass such mitigations. This makes it possible to perform denial of service attacks by sending specially crafted regexes to services accepting user-controlled, untrusted regexes.

## Affected versions

All versions of the `regex` crate before or equal to 1.5.4 are affected by this issue. The fix is include starting from `regex` 1.5.5.

## Mitigations

We recommend everyone…

 https://cve.radiocsirt.org/vuln/suse-ru-2022:1114-1 SUSE-RU-2022:1114-1 — Security update for MozillaFirefox 2026-10-02T18:37:48.093093+00:00

Security update for MozillaFirefox

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-24713 UBUNTU-CVE-2022-24713 2026-10-02T18:37:48.093110+00:00

Affected: Ubuntu:18.04:LTS: firefox, Ubuntu:18.04:LTS: thunderbird, Ubuntu:20.04:LTS: firefox, Ubuntu:20.04:LTS: rust-regex, Ubuntu:20.04:LTS: thunderbird, Ubuntu:22.04:LTS: firefox, Ubuntu:22.04:LTS: rust-regex

regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This guarantee is documented and it's considered part of the crate's API. Unfortunately a bug was discovered in the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing, and it's possible to craft regexes that bypass such mitigations. This makes it possible to perform denial of service attacks by sending specially crafted regexes to services accepting user-controlled, untrusted regexes. All versions of the regex crate before or equal to 1.5.4 are affected by this issue. The fix is include starting from regex 1.5.5. All users accepting user-controlled regexes are recommended to upgrade immediately to the latest version of the regex crate. Unfortunately there is no fixed set of problematic regexes, as there are practically infinite regexes that could be crafted to exploit this vulnerability. Because of this, it us not recommend to deny known problematic regexes.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0482 WID-SEC-W-2022-0482 — Mozilla Firefox, Mozilla Firefox ESR und Thunderbird: Mehrere Schwachstellen 2026-10-02T18:37:48.093143+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Thunderbird ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, falsche Informationen darzustellen und einen Denial-of-Service-Zustand zu verursachen.