Cve-2026-118686 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-118686/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 20:39:06 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgEspoCRM: Denial of service via ReDoS (CVE-2026-118686)https://feed.craftedsignal.io/briefs/2026-10-espocrm-dos/Wed, 28 Oct 2026 20:39:06 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-espocrm-dos/EspoCRM versions before 9.3.11 and 10.x before 10.0.8 are vulnerable to a denial of service attack where an unauthenticated attacker can exhaust server resources by submitting large API requests that trigger a vulnerable password-redaction regex.EspoCRM contains a denial of service vulnerability identified as CVE-2026-118686. The issue resides in the password-redaction regular expression used during API error handling. An unauthenticated remote attacker can exploit this by sending a small number of concurrent, abnormally large API requests. These requests force the application to perform expensive regex operations, leading to high CPU usage, worker exhaustion, and potential service unavailability for legitimate users.

Impact

Successful exploitation results in a denial of service state, where the application becomes slow or completely unresponsive due to exhausted server worker processes.

Recommendation

  • Upgrade EspoCRM to version 9.3.11 or 10.0.8 or later to incorporate the patch for the vulnerable password-redaction logic.
  • Implement request body size limits at the load balancer or web application firewall (WAF) level to prevent the processing of abnormally large API payloads.
  • Audit web server access logs for repeated requests to API endpoints that result in long processing times or HTTP 500/503 errors indicative of worker exhaustion.
]]>lowadvisorydenial-of-serviceweb-applicationredoscve-2026-118686