Cve-2026-118686

EspoCRM versions before 9.3.11 and 10.x before 10.0.8 are vulnerable to a denial of service attack where an unauthenticated attacker can exhaust server resources by submitting large API requests that trigger a vulnerable password-redaction regex.