Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-118686

EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can concurrently send a small number of large API requests to exhaust server workers, making EspoCRM slow or unavailable to legitimate users.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

espocrm espocrm

Default version status: unaffected

  • 10.0.0 to < 10.0.8affected
  • 10.0.8unaffected

espocrm espocrm

Default version status: unaffected

  • 0 to < 9.3.11affected
  • 9.3.11unaffected

References