Résumé
SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header
Détails de l’avis
Impact
SvelteKit is vulnerable to remote CPU-exhaustion DoS attacks via specifically-crafted Accept headers. The impact is mitigated by default header length limits on most platforms, but in the case of raised or absent limits a denial of service is possible.
Patches
The vulnerability is patched in @sveltejs/kit version 2.70.2.
Références
Vulnérabilités liées
Tout Supply chain →- MEDIUMCVE-2026-73556
vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m
- HIGHGHSA-j8pm-gj4c-rq4x
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
- HIGHGHSA-vf76-f5cp-9846
Duplicate Advisory: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions
- HIGHCVE-2026-55520
Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching
- HIGHCVE-2026-57584
Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS
- HIGHCVE-2026-59893
sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)