Inefficient regular expression complexity in EspoCRM - CVE-2026-118686
Published: November 9, 2026 / Updated: November 10, 2026
Vulnerability identifier: #VU162632
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-118686
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to make EspoCRM slow or unavailable to legitimate users.
The vulnerability exists due to excessive CPU consumption in the password-redaction regular expression during error handling when specially crafted API requests contain large bodies. An unauthenticated remote attacker can send a small number of these requests concurrently to exhaust available server workers and disrupt service.
Affected software
EspoCRM
How to mitigate CVE-2026-118686
Install security update from vendor's website.
EspoCRM - addressed in versions 9.3.11, 10.0.8