EspoCRM: Denial of service via ReDoS (CVE-2026-118686)

EspoCRM contains a denial of service vulnerability identified as CVE-2026-118686. The issue resides in the password-redaction regular expression used during API error handling. An unauthenticated remote attacker can exploit this by sending a small number of concurrent, abnormally large API requests. These requests force the application to perform expensive regex operations, leading to high CPU usage, worker exhaustion, and potential service unavailability for legitimate users.

Impact

Successful exploitation results in a denial of service state, where the application becomes slow or completely unresponsive due to exhausted server worker processes.

Recommendation

• Upgrade EspoCRM to version 9.3.11 or 10.0.8 or later to incorporate the patch for the vulnerable password-redaction logic.
• Implement request body size limits at the load balancer or web application firewall (WAF) level to prevent the processing of abnormally large API payloads.
• Audit web server access logs for repeated requests to API endpoints that result in long processing times or HTTP 500/503 errors indicative of worker exhaustion.