Inefficient regular expression complexity in Nautobot - #VU155749
Published: October 14, 2026
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to inefficient regular expression complexity in Nautobot's data validation engine when evaluating submitted values against regular expression validation rules without a bound on backtracking. A remote user can submit crafted model data that introduces catastrophic backtracking into a rule's pattern through enabled Jinja2 context processing to cause a denial of service.
This exploitation path requires add or change permission on the targeted model. Rules are evaluated during model creation and updates, including other users' saves. Sufficient concurrent submissions can exhaust the worker pool. The data compliance audit job also evaluates disabled rules across every object of the targeted content type.