https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T20:13:04.780564+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-69873 CVE-2025-69873 2026-10-07T20:13:05.632545+00:00

Affected: ajv.js ajv, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7, Red Hat Network Observability (NETOBSERV) 1.11.0, Red Hat Ansible Automation Platform 2.6, Red Hat Developer Hub 1.8, Red Hat Developer Hub 1.9, Red Hat Edge Manager 1.0 and 60 more

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.

 https://cve.radiocsirt.org/vuln/ghsa-23c5-xmqv-rm74 GHSA-23c5-xmqv-rm74 — minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions 2026-10-07T20:13:05.632774+00:00

Affected: npm: minimatch

### Summary

Nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally.

---

### Details

The root cause is in `AST.toRegExpSource()` at [`src/ast.ts#L598`](https://github.com/isaacs/minimatch/blob/v10.2.2/src/ast.ts#L598). For the `*` extglob type, the close token emitted is `)*` or `)?`, wrapping the recursive body in `(?:...)*`. When extglobs are nested, each level adds another `*` quantifier around the previous group:

```typescript : this.type === '*' && bodyDotAllowed ? `)?` : `)${this.type}` ```

This produces the following regexps:

| Pattern | Generated regex | |----------------------|------------------------------------------| | `*(a\|b)` | `/^(?:a\|b)*$/` | | `*(*(a\|b))` | `/^(?:(?:a\|b)*)*$/` | | `*(*(*(a\|b)))` | `/^(?:(?:(?:a\|b)*)*)*$/` | | `*(*(*(*(a\|b))))` | `/^(?:(?:(?:(?:a\|b)*)*)*)*$/` |

These are textbook nested-quantifier patterns. Against an input o…