CVE-2026-42567

[CVE catalog]

Severity

Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Published

Jun 9, 2026, 4:22:22 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.45% · Oct 25, 2026

A flaw was found in Svelte, a web framework. An internal regular expression (regex) in the Svelte runtime, specifically when processing `<svelte:element this={tag}></svelte:element>`, can be exploited by a remote attacker. By providing specially crafted input, an attacker can cause the regex to take an exponential amount of time to process, leading to a Regular Expression Denial of Service (ReDoS) condition. This can make the affected application unresponsive or unavailable to legitimate users. svelte: Svelte: Regular Expression Denial of Service (ReDoS) A flaw was found in Svelte. An internal regex in the Svelte runtime can take exponential time when processing specially crafted input in `<svelte:element this={tag}>` elements, leading to a Regular Expression Denial of Service (ReDoS). Red Hat products that ship svelte (Podman Desktop, Konflux) use it as a UI framework and do not expose user-controlled input to the vulnerable regex path in production. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.