CVE-2026-111714 — tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to …
Published: 2026-10-16 · CVSS: 2.3 · CVSS 4.0
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7