https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 12:05:58 +0000 https://cve.radiocsirt.org/vuln/cnvd-2019-01756 cnvd-2019-01756 https://cve.radiocsirt.org/vuln/cnvd-2019-01756 https://cve.radiocsirt.org/vuln/euvd-2026-179551 EUVD-2026-179551 https://cve.radiocsirt.org/vuln/euvd-2026-179551 https://cve.radiocsirt.org/vuln/fkie_cve-2017-16115 <p>The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around 10 seconds.</p> <p>The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around 10 seconds.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2017-16115 https://cve.radiocsirt.org/vuln/ghsa-f523-2f5j-gfcg <p><strong>Affected:</strong> npm: timespan</p> <p>Affected versions of `timespan` are vulnerable to a regular expression denial of service when parsing dates.</p> <p>The amplification for this vulnerability is significant, with 50,000 characters resulting in the event loop being blocked for around 10 seconds.</p> <p>## Recommendation</p> <p>No direct patch is available for this vulnerability.</p> <p>Currently, the best available solution is to use a functionally equivalent alternative package.</p> <p>It is also sufficient to ensure that user input is not being passed into `timespan`, or that the maximum length of such user input is drastically reduced. Limiting the input length to 150 characters should be sufficient in most cases.</p> <p><strong>Affected:</strong> npm: timespan</p> <p>Affected versions of `timespan` are vulnerable to a regular expression denial of service when parsing dates.</p> <p>The amplification for this vulnerability is significant, with 50,000 characters resulting in the event loop being blocked for around 10 seconds.</p> <p>## Recommendation</p> <p>No direct patch is available for this vulnerability.</p> <p>Currently, the best available solution is to use a functionally equivalent alternative package.</p> <p>It is also sufficient to ensure that user input is not being passed into `timespan`, or that the maximum length of such user input is drastically reduced. Limiting the input length to 150 characters should be sufficient in most cases.</p> https://cve.radiocsirt.org/vuln/ghsa-f523-2f5j-gfcg https://cve.radiocsirt.org/vuln/gsd-2017-16115 gsd-2017-16115 https://cve.radiocsirt.org/vuln/gsd-2017-16115