p PatchFirst

CVE-2026-118686

CVE-2026-118686 · EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex

This page contains facts from public vulnerability sources. Check the original advisory before updating.

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can concurrently send a small number of large API requests to exhaust server workers, making EspoCRM slow or unavailable to legitimate users.

CVSS 8.7 · High · EPSS 0.3% · Fix available

Published
Updated

Affected products and versions

  • espocrm

    Versions
    • ≥ 10.0.0, < 10.0.8: Affected (semver)
    • 10.0.8: Not affected (semver)

    Update to 10.0.8

  • espocrm

    Versions
    • ≥ 0, < 9.3.11: Affected (semver)
    • 9.3.11: Not affected (semver)

    Update to 9.3.11

Original sources

Check your server →