EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can concurrently send a small number of large API requests to exhaust server workers, making EspoCRM slow or unavailable to legitimate users.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…spocrm/security/advisories/GHSA-6pjq-v35w-jmjh Üretici bülteni
• vulncheck.com/…denial-of-service-via-password-redaction-regex Üçüncü taraf

Kayıt geçmişi

1. 28 Eki 2026 21:59Yayımlandı

İlgili açıklar

• 4,3 CVE-2026-113643EspoCRM PDF İşleme Hattında Yetkilendirme Atlatma Açığı
• 6,5 CVE-2026-118646n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node
• 5,3 CVE-2026-118259opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing
• 7,5 CVE-2026-116795RE2JS: Quadratic-time denial of service in re2js lookbehind matching
• 7,5 CVE-2026-118037Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadSpreadProcessing and RadSpreadStreamProcessing
• 8,7 CVE-2026-116693dd-trace-js: URL sorgu dizesi gizleme ifadesinde ReDoS zafiyeti