Skip to content
Threat Feed
Subscribe

Product

EspoCRM (< 9.3.11)

1 brief RSS
low advisory

EspoCRM: Denial of service via ReDoS (CVE-2026-118686)

EspoCRM versions before 9.3.11 and 10.x before 10.0.8 are vulnerable to a denial of service attack where an unauthenticated attacker can exhaust server resources by submitting large API requests that trigger a vulnerable password-redaction regex.

EspoCRM +1 denial-of-service web-application redos cve-2026-118686
1t 1c