CVE-2026-4926
path-to-regexp vulnerable to Denial of Service via sequential optional groups
7.5 HighFix available
Impact:
A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as {a}{b}{c}:z. The generated regex grows exponentially with the number of groups, causing denial of service.
Patches:
Fixed in version 8.4.0.
Workarounds:
Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
0.80%Up 0.8 points since Mar 27, 2026
What each source reports
CVE List Score used
path-to-regexp vulnerable to Denial of Service via sequential optional groups
Impact:
A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as {a}{b}{c}:z. The generated regex grows exponentially with the number of groups, causing denial of service.
Patches:
Fixed in version 8.4.0.
Workarounds:
Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
- Record
CVE-2026-4926- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-1333, CWE-1333
- Updated
- 2026-11-02
EUVDEUVD-2026-16324
Impact:
A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as {a}{b}{c}:z. The generated regex grows exponentially with the number of groups, causing denial of service.
Patches:
Fixed in version 8.4.0.
Workarounds:
Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
- Record
EUVD-2026-16324- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j3q9-mxjg-w52f
path-to-regexp vulnerable to Denial of Service via sequential optional groups
Impact
A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as {a}{b}{c}:z. The generated regex grows exponentially with the number of groups, causing denial of service.
Patches
Fixed in version 8.4.0.
Workarounds
Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
- Record
GHSA-j3q9-mxjg-w52f- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-1333
- Updated
- 2026-11-02
NVD
Impact:
A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as {a}{b}{c}:z. The generated regex grows exponentially with the number of groups, causing denial of service.
Patches:
Fixed in version 8.4.0.
Workarounds:
Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
- Record
CVE-2026-4926- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-1333
- Updated
- 2026-11-02
OSV
path-to-regexp vulnerable to Denial of Service via sequential optional groups
Impact:
A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as {a}{b}{c}:z. The generated regex grows exponentially with the number of groups, causing denial of service.
Patches:
Fixed in version 8.4.0.
Workarounds:
Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
- Record
CVE-2026-4926- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333, CWE-400
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-4926
Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as {a}{b}{c}:z. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in version 8.4.0. Workarounds: Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
- Record
DEBIAN-CVE-2026-4926- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-j3q9-mxjg-w52f
path-to-regexp vulnerable to Denial of Service via sequential optional groups
Impact
A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as {a}{b}{c}:z. The generated regex grows exponentially with the number of groups, causing denial of service.
Patches
Fixed in version 8.4.0.
Workarounds
Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
- Record
GHSA-j3q9-mxjg-w52f- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333, CWE-400
- Updated
- 2026-11-02
OSVRHSA-2026:24761
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Record
RHSA-2026:24761- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:24762
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Record
RHSA-2026:24762- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-4926
CVE-2026-4926 in path-to-regexp - Patched by Root
Root has patched CVE-2026-4926 in the path-to-regexp package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-4926- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-4926
Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as {a}{b}{c}:z. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in version 8.4.0. Workarounds: Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
- Record
UBUNTU-CVE-2026-4926- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
- path-to-regexp
- pillarjs path-to-regexp
- red hat cryostat 4
- red hat cryostat 4 on rhel 9
- red hat logging subsystem for red hat openshift
- red hat migration toolkit for virtualization 2.1
- red hat migration toolkit for virtualization 2.9
- red hat multicluster engine for kubernetes
- red hat network observability operator
- red hat openshift lightspeed
- red hat openshift pipelines
- red hat openshift service mesh 2
Show 41 moreShow less
- red hat openshift service mesh 3
- red hat advanced cluster management for kubernetes 2
- red hat advanced cluster security 4
- red hat amq broker 7
- red hat ansible automation platform 2
- red hat ansible automation platform 2.5 for rhel 8
- red hat ansible automation platform 2.5 for rhel 9
- red hat ansible automation platform 2.6
- red hat ansible automation platform 2.6 for rhel 9
- red hat build of apache camel - hawtio 4
- red hat build of apicurio registry 2
- red hat build of podman desktop
- red hat data grid 8
- red hat developer hub
- red hat developer hub 1.8
- red hat developer hub 1.9
- red hat edge manager 1.0
- red hat edge manager 1.1
- red hat enterprise linux 10
- red hat enterprise linux 8
- red hat enterprise linux 9
- red hat fuse 7
- red hat jboss enterprise application platform 7
- red hat jboss enterprise application platform 8
- red hat jboss enterprise application platform expansion pack
- red hat migration toolkit for applications 8.1
- red hat openshift ai (rhoai)
- red hat openshift ai 2.25
- red hat openshift container platform 4
- red hat openshift data foundation 4
- red hat openshift dev spaces 3.27
- red hat openshift distributed tracing 3.9.3
- red hat openshift gitops
- red hat openshift virtualization 4
- red hat process automation 7
- red hat quay 3
- red hat satellite 6
- red hat single sign-on 7
- red hat trusted artifact signer 1.3
- red hat trusted profile analyzer
- red hat self-service automation portal 2
Affected packages
| Package | Affected | Fixed |
|---|---|---|
path-to-regexpnpm |
8.0.0 up to 8.4.0 | 8.4.0 |
node-path-to-regexpDebian:12 |
All versions, plus listed versions 6.2.1-16.3.0-18.3.0-18.4.0-18.4.1-18.4.2-1 |
None known |
node-path-to-regexpDebian:13 |
All versions, plus listed versions 6.3.0-18.3.0-18.4.0-18.4.1-18.4.2-1 |
None known |
node-path-to-regexpDebian:14 |
before 8.4.0-1, plus listed versions 6.3.0-18.3.0-1 |
8.4.0-1 |
automation-gateway-serverRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 16 CVEs |
before 0:2.5.20260422-3.el8ap | 0:2.5.20260422-3.el8ap |
automation-gateway-serverRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 16 CVEs |
before 0:2.5.20260422-3.el9ap | 0:2.5.20260422-3.el9ap |
python3.12-clickRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 16 CVEs |
before 0:8.3.3-1.el8ap | 0:8.3.3-1.el8ap |
python3.12-clickRed Hat:ansible_automation_platform_inside:2.5::el8 From an advisory covering 16 CVEs |
before 0:8.3.3-1.el8ap | 0:8.3.3-1.el8ap |
python3.12-clickRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 16 CVEs |
before 0:8.3.3-1.el8ap | 0:8.3.3-1.el8ap |
python3.12-clickRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 16 CVEs |
before 0:8.3.3-1.el9ap | 0:8.3.3-1.el9ap |
Show 63 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python3.12-clickRed Hat:ansible_automation_platform_inside:2.5::el9 From an advisory covering 16 CVEs |
before 0:8.3.3-1.el9ap | 0:8.3.3-1.el9ap |
python3.12-clickRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 16 CVEs |
before 0:8.3.3-1.el9ap | 0:8.3.3-1.el9ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 16 CVEs |
before 0:4.6.29-2.el8ap | 0:4.6.29-2.el8ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 16 CVEs |
before 0:4.6.29-2.el9ap | 0:4.6.29-2.el9ap |
receptorRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 16 CVEs |
before 0:1.6.5-1.el8ap | 0:1.6.5-1.el8ap |
receptorRed Hat:ansible_automation_platform_inside:2.5::el8 From an advisory covering 16 CVEs |
before 0:1.6.5-1.el8ap | 0:1.6.5-1.el8ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 16 CVEs |
before 0:2.5.10-6.el8ap | 0:2.5.10-6.el8ap |
receptorRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 16 CVEs |
before 0:1.6.5-1.el8ap | 0:1.6.5-1.el8ap |
receptorRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 16 CVEs |
before 0:1.6.5-1.el9ap | 0:1.6.5-1.el9ap |
receptorRed Hat:ansible_automation_platform_inside:2.5::el9 From an advisory covering 16 CVEs |
before 0:1.6.5-1.el9ap | 0:1.6.5-1.el9ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 16 CVEs |
before 0:2.6.14-3.el9ap | 0:2.6.14-3.el9ap |
receptorRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 16 CVEs |
before 0:1.6.5-1.el9ap | 0:1.6.5-1.el9ap |
python3.12-cryptographyRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 16 CVEs |
before 0:46.0.7-1.el8ap | 0:46.0.7-1.el8ap |
python3.12-cryptographyRed Hat:ansible_automation_platform_inside:2.5::el8 From an advisory covering 16 CVEs |
before 0:46.0.7-1.el8ap | 0:46.0.7-1.el8ap |
python3.12-cryptographyRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 16 CVEs |
before 0:46.0.7-1.el8ap | 0:46.0.7-1.el8ap |
python3.12-cryptographyRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 16 CVEs |
before 0:46.0.7-1.el9ap | 0:46.0.7-1.el9ap |
python3.12-cryptographyRed Hat:ansible_automation_platform_inside:2.5::el9 From an advisory covering 16 CVEs |
before 0:46.0.7-1.el9ap | 0:46.0.7-1.el9ap |
python3.12-cryptographyRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 16 CVEs |
before 0:46.0.7-1.el9ap | 0:46.0.7-1.el9ap |
python3.12-pillowRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 16 CVEs |
before 0:12.2.0-1.el8ap | 0:12.2.0-1.el8ap |
python3.12-pillowRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 16 CVEs |
before 0:12.2.0-1.el9ap | 0:12.2.0-1.el9ap |
automation-platform-uiRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:2.6.9-1.el9ap | 0:2.6.9-1.el9ap |
python3-clickRed Hat:ansible_automation_platform_developer:2.6::el10 From an advisory covering 12 CVEs |
before 0:8.3.3-1.el10ap | 0:8.3.3-1.el10ap |
python3-clickRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 12 CVEs |
before 0:8.3.3-1.el10ap | 0:8.3.3-1.el10ap |
python3.12-clickRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 12 CVEs |
before 0:8.3.3-1.el9ap | 0:8.3.3-1.el9ap |
python3.12-clickRed Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 12 CVEs |
before 0:8.3.3-1.el9ap | 0:8.3.3-1.el9ap |
python3.12-clickRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:8.3.3-1.el9ap | 0:8.3.3-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 12 CVEs |
before 0:4.7.12-1.el9ap | 0:4.7.12-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 12 CVEs |
before 0:4.7.12-1.el9ap | 0:4.7.12-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:4.7.12-1.el9ap | 0:4.7.12-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:4.7.12-1.el9ap | 0:4.7.12-1.el9ap |
automation-controller-serverRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:4.7.12-1.el9ap | 0:4.7.12-1.el9ap |
automation-controller-uiRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:4.7.12-1.el9ap | 0:4.7.12-1.el9ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:4.7.12-1.el9ap | 0:4.7.12-1.el9ap |
receptorRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 12 CVEs |
before 0:1.6.5-1.el10ap | 0:1.6.5-1.el10ap |
receptor-debuginfoRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 12 CVEs |
before 0:1.6.5-1.el10ap | 0:1.6.5-1.el10ap |
receptor-debugsourceRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 12 CVEs |
before 0:1.6.5-1.el10ap | 0:1.6.5-1.el10ap |
receptorctlRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 12 CVEs |
before 0:1.6.5-1.el10ap | 0:1.6.5-1.el10ap |
receptorRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 12 CVEs |
before 0:1.6.5-1.el9ap | 0:1.6.5-1.el9ap |
receptorctlRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 12 CVEs |
before 0:1.6.5-1.el9ap | 0:1.6.5-1.el9ap |
receptorRed Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 12 CVEs |
before 0:1.6.5-1.el9ap | 0:1.6.5-1.el9ap |
receptorctlRed Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 12 CVEs |
before 0:1.6.5-1.el9ap | 0:1.6.5-1.el9ap |
automation-gateway-proxyRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:2.6.14-3.el9ap | 0:2.6.14-3.el9ap |
automation-gateway-proxy-debugsourceRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:2.6.14-3.el9ap | 0:2.6.14-3.el9ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:2.6.14-3.el9ap | 0:2.6.14-3.el9ap |
automation-gateway-proxy-server-debuginfoRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:2.6.14-3.el9ap | 0:2.6.14-3.el9ap |
receptorRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:1.6.5-1.el9ap | 0:1.6.5-1.el9ap |
receptor-debuginfoRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:1.6.5-1.el9ap | 0:1.6.5-1.el9ap |
receptor-debugsourceRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:1.6.5-1.el9ap | 0:1.6.5-1.el9ap |
receptorctlRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:1.6.5-1.el9ap | 0:1.6.5-1.el9ap |
python3.12-cryptographyRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 12 CVEs |
before 0:46.0.7-1.el9ap | 0:46.0.7-1.el9ap |
python3.12-cryptography-debuginfoRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 12 CVEs |
before 0:46.0.7-1.el9ap | 0:46.0.7-1.el9ap |
python3.12-cryptography-debugsourceRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 12 CVEs |
before 0:46.0.7-1.el9ap | 0:46.0.7-1.el9ap |
python3.12-cryptographyRed Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 12 CVEs |
before 0:46.0.7-1.el9ap | 0:46.0.7-1.el9ap |
python3.12-cryptography-debuginfoRed Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 12 CVEs |
before 0:46.0.7-1.el9ap | 0:46.0.7-1.el9ap |
python3.12-cryptography-debugsourceRed Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 12 CVEs |
before 0:46.0.7-1.el9ap | 0:46.0.7-1.el9ap |
python3.12-cryptographyRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:46.0.7-1.el9ap | 0:46.0.7-1.el9ap |
python3.12-cryptography-debuginfoRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:46.0.7-1.el9ap | 0:46.0.7-1.el9ap |
python3.12-cryptography-debugsourceRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:46.0.7-1.el9ap | 0:46.0.7-1.el9ap |
python3.12-pillowRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:12.2.0-1.el9ap | 0:12.2.0-1.el9ap |
python3.12-pillow-debuginfoRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:12.2.0-1.el9ap | 0:12.2.0-1.el9ap |
python3.12-pillow-debugsourceRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:12.2.0-1.el9ap | 0:12.2.0-1.el9ap |
path-to-regexpRoot:npm |
before 8.3.0-aikido.2 | 8.3.0-aikido.28.3.0-aikido.38.2.0-aikido.38.3.0-aikido.4 |
@rootio/path-to-regexpRoot:npm |
before 8.3.0-root.io.1 | 8.3.0-root.io.18.3.0-root.io.28.3.0-root.io.38.2.0-root.io.18.2.0-root.io.38.3.0-root.io.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-4926 is a high vulnerability (CVSS 7.5) in Path-to-regexp, published March 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.80%, the 57th percentile. Fixed in path-to-regexp 8.4.0.
References
cna.openjsf.org/security-advisories.html
access.redhat.com/security/cve/CVE-2026-4926
bugzilla.redhat.com/show_bug.cgi?id=2451867
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4926.json
Show 145 moreShow less
github.com/pillarjs/path-to-regexp/security/advisories/GHSA-j3q9-mxjg-w52f
nvd.nist.gov/vuln/detail/CVE-2026-4926
security-tracker.debian.org/tracker/CVE-2026-4926
docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases
cve.org/CVERecord?id=CVE-2025-62718
datatracker.ietf.org/doc/html/rfc1034
go.dev/cl/758320
groups.google.com/g/golang-announce/c/0uYbvbPZRWU
pkg.go.dev/vuln/GO-2026-4947
mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE
rfc-editor.org/rfc/rfc8017.html
openwall.com/lists/oss-security/2026/04/08/12
pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html
ubuntu.com/security/CVE-2026-4926