{"id":"CVE-2026-118686","published":"2026-10-28T19:17:35.633","lastModified":"2026-10-28T19:17:35.760","description":"EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can concurrently send a small number of large API requests to exhaust server workers, making EspoCRM slow or unavailable to legitimate users.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-1333"],"vendors":[],"products":[],"references":[{"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-6pjq-v35w-jmjh","tags":[]},{"url":"https://www.vulncheck.com/advisories/espocrm-before-9.3.11-and-10.0.8-unauthenticated-denial-of-service-via-password-redaction-regex","tags":[]}],"exploitRefs":[{"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-6pjq-v35w-jmjh","tags":[]}],"hasPoc":true,"ai":null}