CVE-2026-62864
High · 7.5CVSS
7.5
EPSS
—
Published
Oct 30, 2026
CISA due date
—
The record
Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. Prior to 1.15.5, `wrap-nested-params` in the `ring.middleware.nested-params` namespace uses a backtracking regular expression to match parameter names from URL query strings and HTTP request bodies. An attacker can craft a parameter name that drives quadratic O(n^2) matching work, causing regular-expression denial of service in applications using the middleware. `Ring-Defaults` users are also exposed because nested-params is enabled by default. Applications omitting the middleware do not expose this parsing path. This issue is fixed in version 1.15.5.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119300 Wekan is open source kanban built with Meteor. CWE-1333
- CVE-2026-118993 CallBackery versions before 0.62.0 for Perl allow denial of service via the request path… CWE-1333
- CVE-2026-115866 Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular… CWE-1333
- CVE-2026-119202 @hapi/content provides HTTP Content-* header parsing. CWE-1333
- CVE-2026-118779 Forge (also called node-forge) is a native implementation of Transport Layer Security in… CWE-1333
- CVE-2026-118772 joi is a schema description language and data validator for JavaScript. CWE-1333
- CVE-2026-118686 EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability… CWE-1333
- CVE-2026-118646 n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service… CWE-1333