https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 17:54:48 +0000 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0279 certfr-2025-avi-0279 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0279 https://cve.radiocsirt.org/vuln/euvd-2026-217761 EUVD-2026-217761 https://cve.radiocsirt.org/vuln/euvd-2026-217761 https://cve.radiocsirt.org/vuln/fkie_cve-2025-25289 <p>@octokit/request-error is an error class for Octokit request errors. Starting in version 1.0.0 and prior to version 6.1.7, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the processing of HTTP request headers. By sending an authorization header containing an excessively long sequence of spaces followed by a newline and &#34;@&#34;, an attacker can exploit inefficient regular expression processing, leading to excessive resource consumption. This can significantly degrade server performance or cause a denial-of-service (DoS) condition, impacting availability. Version 6.1.7 contains a fix for the issue.</p> <p>@octokit/request-error is an error class for Octokit request errors. Starting in version 1.0.0 and prior to version 6.1.7, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the processing of HTTP request headers. By sending an authorization header containing an excessively long sequence of spaces followed by a newline and &#34;@&#34;, an attacker can exploit inefficient regular expression processing, leading to excessive resource consumption. This can significantly degrade server performance or cause a denial-of-service (DoS) condition, impacting availability. Version 6.1.7 contains a fix for the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-25289 https://cve.radiocsirt.org/vuln/ghsa-xx4v-prfh-6cgc <p><strong>Affected:</strong> npm: @octokit/request-error</p> <p>### Summary A Regular Expression Denial of Service (ReDoS) vulnerability exists in the processing of HTTP request headers. By sending an authorization header containing an excessively long sequence of spaces followed by a newline and &#34;@&#34;, an attacker can exploit inefficient regular expression processing, leading to excessive resource consumption. This can significantly degrade server performance or cause a denial-of-service (DoS) condition, impacting availability. ### Details The issue occurs at [line 52](https://github.com/octokit/request-error.js/blob/main/src/index.ts) of iterator.ts in the @octokit/request-error repository. The vulnerability is caused by the use of an inefficient regular expression in the handling of the `authorization` header within the request processing logic: ```js authorization: options.request.headers.authorization.replace( / .*$/, &#34; [REDACTED]&#34; ) ``` The regular expression `/ .*$/` matches a space followed by any number of characters until the end of the line. This pattern is vulnerable to Regular Expression Denial of Service (ReDoS) when processing specially crafted input. Specifically, an attacker can send an `authorization` header containing a long sequence of spaces followed by a newline and &#34;@&#34;, such as: ```js headers: { authorization: &#34;&#34; + &#34; &#34;.repeat(100000) + &#34;\n@&#34;, } ``` Due to the way JavaScript&#39;s regular expression engine backtracks while attempting to match the space followed by arbitrary characters, this input can cause excessiv…</p> <p><strong>Affected:</strong> npm: @octokit/request-error</p> <p>### Summary A Regular Expression Denial of Service (ReDoS) vulnerability exists in the processing of HTTP request headers. By sending an authorization header containing an excessively long sequence of spaces followed by a newline and &#34;@&#34;, an attacker can exploit inefficient regular expression processing, leading to excessive resource consumption. This can significantly degrade server performance or cause a denial-of-service (DoS) condition, impacting availability. ### Details The issue occurs at [line 52](https://github.com/octokit/request-error.js/blob/main/src/index.ts) of iterator.ts in the @octokit/request-error repository. The vulnerability is caused by the use of an inefficient regular expression in the handling of the `authorization` header within the request processing logic: ```js authorization: options.request.headers.authorization.replace( / .*$/, &#34; [REDACTED]&#34; ) ``` The regular expression `/ .*$/` matches a space followed by any number of characters until the end of the line. This pattern is vulnerable to Regular Expression Denial of Service (ReDoS) when processing specially crafted input. Specifically, an attacker can send an `authorization` header containing a long sequence of spaces followed by a newline and &#34;@&#34;, such as: ```js headers: { authorization: &#34;&#34; + &#34; &#34;.repeat(100000) + &#34;\n@&#34;, } ``` Due to the way JavaScript&#39;s regular expression engine backtracks while attempting to match the space followed by arbitrary characters, this input can cause excessiv…</p> https://cve.radiocsirt.org/vuln/ghsa-xx4v-prfh-6cgc