CWE-185.

Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder

• MongoDB C# Driver
• CWE-185

follow-redirects sensitiveHeaders regex escaping can expose credential headers

• Information disclosure
• CWE-185

>=1.16.0, <1.16.1 · fixed in 1.16.1

Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

• Broken access control
• CWE-185

>=3.0.0, <3.2.4 · fixed in 3.2.4

GitHub CLI allows attestation verification bypass through unescaped regex metacharacters

• CWE-185

<2.97.0 · fixed in 2.97.0

Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field

• givanz Vvveb
• Cross-site scripting (XSS)
• CWE-116

Consul vulnerable to an authorization bypass in the Connect service mesh

• HashiCorp Consul
• HashiCorp Consul Enterprise
• CWE-185

@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

• CWE-185

<8.1.2 · fixed in 8.1.2

Webmin information disclosure via regex pattern

• Webmin
• CWE-185
• CWE-777

Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker

• Cross-site request forgery (CSRF)
• CWE-185

<3.35.4 · fixed in 3.35.4

Hono: IP Restriction bypasses static deny rules for non-canonical IPv6

• CWE-185
• CWE-1289

<4.12.21 · fixed in 4.12.21

Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection

• Open redirect
• CWE-185

<5.4.52 || >=6.0.0, <6.4.40 || >=7.0.0, <7.4.12 || >=8.0.0, <8.0.12 · fixed in 5.4.52, 6.4.40, 7.4.12, 8.0.12

Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypass

• GitHub Enterprise Server
• CWE-185

Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching

• CWE-185

>=0.43.0, <1.0.2 || >=1.2.0, <1.3.4 || >=1.4.0, <1.6.2 || >=1.7.0, <1.9.3 || >=1.10.0, <1.11.1 · fixed in 1.0.2, 1.3.4, 1.6.2, 1.9.3, 1.11.1

Istio: AuthorizationPolicy serviceAccounts regex injection via unescaped dots

• Broken access control
• CWE-185

>=0.0.0-20241024090207-0bf27d49ba4b, <0.0.0-20260403004500-692e460c342d · fixed in 0.0.0-20260403004500-692e460c342d

OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure

• Information disclosure
• CWE-185

<2026.3.28 · fixed in 2026.3.28

SVG Dimension Capping Bypass via XML Comment Injection in @dicebear/converter ensureSize()

• CWE-185

<9.4.2 · fixed in 9.4.2

league/commonmark has an embed extension allowed_domains bypass

• Cross-site scripting (XSS)
• Server-side request forgery (SSRF)

>=2.3.0, <2.8.2 · fixed in 2.8.2

LAM has incorrect regular expression in PDF export component that allows user to upload files of any type

• LDAPAccountManager lam
• CWE-185

Fastify's Missing End Anchor in "subtypeNameReg" Allows Malformed Content-Types to Pass Validation

• CWE-185

>=5.7.2, <5.8.1 · fixed in 5.8.1

fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

• Cross-site scripting (XSS)
• CWE-185

>=4.1.3, <4.5.4 || >=5.0.0, <5.3.5 · fixed in 4.5.4, 5.3.5

Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in configured host patterns

• CWE-185

>=2.19.0, <2.20.0 · fixed in 2.20.0

Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing

• CWE-185

<4.11.7 · fixed in 4.11.7

FastAPI Guard has a regex bypass

• Denial of service
• CWE-20

>=3.0.1, <3.0.2 · fixed in 3.0.2

Cisco Enterprise Chat and Email: A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could…

• Cisco Enterprise Chat and Email
• CWE-185

parse-uri Regular expression Denial of Service (ReDoS)

• Denial of service
• CWE-185

<=1.0.9 · no fixed version yet

authentik has an insecure default configuration for OAuth2 Redirect URIs

• authentik
• CWE-185

Butterfly's parseJSON, getJSON functions eval malicious input, leading to remote code execution (RCE)

• Code injection
• CWE-185

<1.2.6 · fixed in 1.2.6

WP Hardening – Fix Your WordPress Security <= 1.2.6 - Unauthenticated Security Feature Bypass to Username Enumeration

• astrasecuritysuite WP Hardening (discontinued)
• CWE-185

Incorrect Regular Expression in GravityZone Update Server (VA-11465)

• Bitdefender GravityZone Control Center (On Premises)
• Bitdefender Endpoint Security for Windows
• CWE-185

Incorrect default pattern in Jenkins Audit Trail Plugin

• CWE-185

<3.7 · fixed in 3.7

Istio ReDoS Vulnerability

• CWE-185

<1.1.13 || >=1.2.0, <1.2.4 · fixed in 1.1.13, 1.2.4

Regular Expression Denial of Service (ReDoS) in braces

• Denial of service
• CWE-185

>=2.2.0, <2.3.1 · fixed in 2.3.1

DoS attack using PostMaster filters

• OTRS AG ((OTRS)) Community Edition
• OTRS
• CWE-185

Incorrect Regular Expression in RestSharp

• CWE-185
• CWE-697

<106.11.8-alpha.0.13 · fixed in 106.11.8-alpha.0.13

Specially crafted regex query can cause DoS

• MongoDB Inc. MongoDB Server
• CWE-185

Cisco IOS and IOS XE Software Split DNS Denial of Service Vulnerability

• Cisco IOS
• CWE-185

Regular Expression Denial of Service in papaparse

• Denial of service
• CWE-185

<5.2.0 · fixed in 5.2.0

Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion.

• Elastic Kibana
• CWE-185

bypass of manageRedirect in GLPI

• GLPI
• Open redirect
• CWE-185

A flaw was found in openshift-ansible.

• Red Hat openshift-ansible
• CWE-185

Duplicate Advisory: Regular Expression Denial of Service in braces

• Denial of service
• CWE-185

<2.3.1 · fixed in 2.3.1

uap-core Regular Expression Denial of Service issue

• CWE-185

<0.6.0 · fixed in 0.6.0

Django denial-of-service possibility in urlize and urlizetrunc template filters

• CWE-185

>=1.8a1, <1.8.19 || >=1.11a1, <1.11.11 || >=2.0a1, <2.0.3 · fixed in 1.8.19, 1.11.11, 2.0.3

Django Denial-of-service possibility in truncatechars_html and truncatewords_html template filters

• CWE-185

>=1.8, <1.8.19 || >=1.11, <1.11.11 || >=2.0, <2.0.3 · fixed in 1.8.19, 1.11.11, 2.0.3

js-bson vulnerable to REDoS

• Denial of service
• CWE-185

>=0.5.0, <1.0.5 · fixed in 1.0.5

Mosca REDoS Vulnerability

• CWE-20
• CWE-185

<2.8.2 · fixed in 2.8.2

Regular Expression Denial of Service in sshpk

• Denial of service
• CWE-185

<1.13.2 · fixed in 1.13.2

Node.js: The `'path'` module in the Node.js 4.x release line contains a potential regular…

• Node.js
• CWE-185