missing CVE-* comment added
backtrack pattern added