Resource exhaustion in Wekan - #VU145032
Published: August 25, 2026
Vulnerability identifier: #VU145032
CSH Severity: Medium
CVSS v4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the user-search DDP publication when processing a user-supplied regular expression. A remote user can submit repeated subscriptions with a crafted regex pattern to cause a denial of service.
The search term is passed directly to RegExp construction without sanitization, enabling catastrophic backtracking during database regex evaluation.
Affected software
Wekan
Remediation
Install security update from vendor's website.
Wekan - update to 11.11