CVE-2026-23956
Description
A flaw was found in seroval, a JavaScript (JS) value stringification library. A remote attacker could exploit this vulnerability by providing specially crafted regular expressions during deserialization. This could lead to the exhaustion of JavaScript runtime memory or trigger a Regular Expression Denial of Service (ReDoS), making the application unavailable to legitimate users.
Statement
This vulnerability is rated Important for Red Hat as it can lead to a Denial of Service in applications utilizing the seroval library. Specifically, versions 1.4.0 and below are susceptible to memory exhaustion or Regular Expression Denial of Service (ReDoS) when processing maliciously crafted serialized regular expressions. This affects community projects such as Forgejo in Fedora and EPEL.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
