CVE-2026-44796: Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)
Impact
Nautobot UI object-bulk-rename endpoints (for example, /dcim/interfaces/rename/) were vulnerable to application-wide denial of service via maliciously crafted regular expressions in the find field in combination with the useregex flag.
Patches
A general-purpose timeout has been added to these endpoints in Nautobot v2.4.33 and v3.1.2, which ensures that the request will fail early with an appropriate message if regular expression evaluation takes more than a short period of time, instead of continuing to execute for an indefinite duration.
Workarounds
No known workaround has been identified at this time.
References
- 2.4.33 (<a href="https://github.com/nautobot/nautobot/commit/c2b766966d814a7141f62c7bc90c85fefb7892ee">patch</a>) - 3.1.2 (<a href="https://github.com/nautobot/nautobot/commit/5a30d0916953afbeedd24a784709e762cc3879cd">patch</a>)
Other sources
Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot UI object-bulk-rename endpoints (for example, /dcim/interfaces/rename/) were vulnerable to application-wide denial of service via maliciously crafted regular expressions in the find field in combination with the useregex flag. This vulnerability is fixed in 2.4.33 and 3.1.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/nautobotto a version that resolves this vulnerability.Fixed in 2.4.33 - Upgrade
Upgrade
pip/nautobotto a version that resolves this vulnerability.Fixed in 3.1.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44796?
CVE-2026-44796 has been identified as a denial of service vulnerability impacting Nautobot UI.
How do I fix CVE-2026-44796?
To resolve CVE-2026-44796, upgrade Nautobot to version 2.4.33 or 3.1.2 or later.
What is the impact of exploiting CVE-2026-44796?
Exploiting CVE-2026-44796 can lead to an application-wide denial of service through maliciously crafted regular expressions.
Which Nautobot versions are affected by CVE-2026-44796?
Nautobot versions prior to 2.4.33 and between 3.0.0a2 and 3.1.2 are affected by CVE-2026-44796.
What is the context for the CVE-2026-44796 vulnerability?
CVE-2026-44796 specifically affects the object-bulk-rename endpoints in the Nautobot UI.