{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/espocrm--9.3.11/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-118686"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["EspoCRM (\u003c 9.3.11)","EspoCRM (10.x \u003c 10.0.8)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","web-application","redos","cve-2026-118686"],"_cs_type":"advisory","_cs_vendors":["EspoCRM"],"content_html":"\u003cp\u003eEspoCRM contains a denial of service vulnerability identified as CVE-2026-118686. The issue resides in the password-redaction regular expression used during API error handling. An unauthenticated remote attacker can exploit this by sending a small number of concurrent, abnormally large API requests. These requests force the application to perform expensive regex operations, leading to high CPU usage, worker exhaustion, and potential service unavailability for legitimate users.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a denial of service state, where the application becomes slow or completely unresponsive due to exhausted server worker processes.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade EspoCRM to version 9.3.11 or 10.0.8 or later to incorporate the patch for the vulnerable password-redaction logic.\u003c/li\u003e\n\u003cli\u003eImplement request body size limits at the load balancer or web application firewall (WAF) level to prevent the processing of abnormally large API payloads.\u003c/li\u003e\n\u003cli\u003eAudit web server access logs for repeated requests to API endpoints that result in long processing times or HTTP 500/503 errors indicative of worker exhaustion.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T20:39:06Z","date_published":"2026-10-28T20:39:06Z","id":"https://feed.craftedsignal.io/briefs/2026-10-espocrm-dos/","summary":"EspoCRM versions before 9.3.11 and 10.x before 10.0.8 are vulnerable to a denial of service attack where an unauthenticated attacker can exhaust server resources by submitting large API requests that trigger a vulnerable password-redaction regex.","title":"EspoCRM: Denial of service via ReDoS (CVE-2026-118686)","url":"https://feed.craftedsignal.io/briefs/2026-10-espocrm-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - EspoCRM (\u003c 9.3.11)","version":"https://jsonfeed.org/version/1.1"}