CWE-625.

CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list

• Denial of service
• CWE-625

CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse

• Denial of service
• CWE-625

CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator

• CWE-625

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

• CWE-625

>=2.0.0, <2.13.0 · fixed in 2.13.0

Permissive Regular Expression in GitLab

• GitLab
• CWE-625

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

• Cross-site scripting (XSS)
• Code injection

>=3.0.0, <4.5.11 || >=4.6.0, <4.6.4 · fixed in 4.5.11, 4.6.4

Astro: Netlify Image CDN allowlist bypass enables SSRF

• Server-side request forgery (SSRF)
• CWE-625

>=5.2.0, <8.2.4 · fixed in 8.2.4

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control of Critical State Data vulnerability.

• Dell Secure Connect Gateway 5.0 - Application
• Dell Secure Connect Gateway 5.0 - Appliance
• CWE-625

xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

• Other injection
• CWE-625

>=0.9.11, <0.9.12 · fixed in 0.9.12

xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path

• Other injection
• CWE-625

>=0.9.0, <0.9.12 · fixed in 0.9.12

xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator

• Other injection
• CWE-625

>=0.9.10, <0.9.12 · fixed in 0.9.12

CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)

• Server-side request forgery (SSRF)
• CWE-20

<0.4.112 · fixed in 0.4.112

AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

• CWE-178
• CWE-625

>=2.1.26, <2.3.25 · fixed in 2.3.25

PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

• Broken access control
• CWE-625

<4.6.58 · fixed in 4.6.58

Stackrox: stackrox: privilege escalation via unanchored regular expressions in auth m2m role mappings

• Red Hat Advanced Cluster Security 4
• CWE-625

Nishishi Factory Tegalog -Fumy Otegaru Memo Logger-: Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability…

• Nishishi Factory Tegalog -Fumy Otegaru Memo Logger-
• CWE-625

sanic-cors contains an improper regular expression in the try_match() function

• CWE-346
• CWE-625

<=2.2.0 · no fixed version yet

CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters

• Cross-site scripting (XSS)
• CWE-116

<2.2.7 || >=3.0.0.beta, <3.1.3 · fixed in 2.2.7, 3.1.3

Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat`

• CWE-625
• CWE-777

<2.18.0 · fixed in 2.18.0

Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect

• CWE-625

<2.2.23 || >=3.0.0.beta1, <3.1.21 || >=3.2.0, <3.2.6 · fixed in 2.2.23, 3.1.21, 3.2.6

Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory

• CWE-625

<2.2.23 || >=3.0.0.beta1, <3.1.21 || >=3.2.0, <3.2.6 · fixed in 2.2.23, 3.1.21, 3.2.6

OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths

• CWE-178
• CWE-625

<2026.3.11 · fixed in 2026.3.11

Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability

• Microsoft ACI Confidential Containers
• CWE-625

Keycloak Authorization Bypass vulnerability

• CWE-625

<22.0.10 || >=23.0.0, <24.0.3 · fixed in 22.0.10, 24.0.3

Improper Input Validation in Google Closure Library

• CWE-20
• CWE-625

<20200315.0.0 · fixed in 20200315.0.0

Synology Photo Station: Permissive regular expression vulnerability in synophoto_dsm_user in Synology Photo…

• Synology Photo Station
• CWE-625