CVE-2026-59966: Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout when an authenticated user stores a catastrophic-backtracking regex and any user in the same Space imports a matching recipe. Request processing uses Automation.param2, applyregexreplaceautomation, sub, api/recipe-from-source/. The attack works because the shared-Space automation engine evaluates the malicious pattern during recipe import and can occupy a Gunicorn worker until its request timeout. This can exhaust application worker slots and make the service unavailable to users. This issue is fixed in version 2.6.10.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tandoor Recipesto a version that resolves this vulnerability.Fixed in 2.6.10
Event History
Frequently Asked Questions
Who can trigger the denial of service, and what access do they need?
An authenticated user who can store an Automation regular-expression pattern can introduce the malicious pattern. Exploitation is triggered when any user in the same Space imports a recipe that matches the pattern.
Are shared Spaces the relevant exposure boundary?
Yes. The vulnerable automation is evaluated during recipe import within the shared Space, so users who share a Space with someone able to configure Automations are exposed to that user's regex patterns.
What is the operational impact of a successful exploit?
A catastrophic-backtracking pattern can occupy a Gunicorn worker until the request timeout. Repeated or concurrent triggering can exhaust worker slots and make the application unavailable.
What should be done if an immediate upgrade is not possible?
The provided information identifies user-controlled Automation regex patterns as the source of exposure. Restrict or avoid untrusted users creating such Automations, particularly in Spaces where other users import recipes, until version 2.6.10 can be deployed.
How can administrators identify potentially affected deployments?
Deployments earlier than 2.6.10 are affected when they use Automation regex replacement through Automation.param_2 and allow recipe imports through the recipe-from-source API path. Review existing Space Automations for suspicious or catastrophic-backtracking regular-expression patterns.