CWE-777: Regular Expression without Anchors
The product uses a regular expression to perform neutralization, but the regular expression is not anchored and may allow malicious or malformed data to slip through.
4 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2026-40110 — jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat
- CVE-2026-56021 — Webmin information disclosure via regex pattern
- CVE-2026-22068 — Apache Traffic Server: Regex mappings match with malicious domain names
- CVE-2026-39087 — ntfy before 2.22.0 allows SSRF because of an unanchored regular expression.
Recently published
- CVE-2026-22068 — Apache Traffic Server: Regex mappings match with malicious domain names
- CVE-2026-56021 — Webmin information disclosure via regex pattern
- CVE-2026-40110 — jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat
- CVE-2026-39087 — ntfy before 2.22.0 allows SSRF because of an unanchored regular expression.