Live › vulnerability › CVE-2026-118686
Go to dashboardEspoCRM's password-redaction regular expression, run during API error handling, uses excessive CPU when request bodies are long. An unauthenticated remote attacker can send a few large API requests at once to tie up server workers and make the CRM slow or unavailable.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 19:34 UTC. All times on this page are UTC.
Any internet-reachable EspoCRM instance running a version before 9.3.11 or in the 10.x line before 10.0.8 is exposed, because the vulnerable API error path needs no login. Instances kept behind a VPN or an authenticating proxy with no public API route are at much lower risk. Teams on a patched version can skip it.
No product ranges from the sources yet.
package.json or the admin panel; versions below 9.3.11 or 10.0.8 in the 10.x line are affected9.3.11 or later10.0.8 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can concurrently send a small number of large API requests to exhaust server workers, making EspoCRM slow or unavailable to legitimate users.
This page as .md · .json · in your agent: get_signal("CVE-2026-118686")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.