GHSA-6pjq-v35w-jmjh: EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex

Published Oct 28, 2026

Updated

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can concurrently send a small number of large API requests to exhaust server workers, making EspoCRM slow or unavailable to legitimate users.

Event History

Oct 28, 2026

CVE Published

via OSV·06:59 PM

Data Sourced

via OSV·06:59 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

EspoCRM versions before 9.3.11 and 10.x versions before 10.0.8 are affected. The issue is reachable through API error handling.

Does an attacker need an account or user interaction?

No. Unauthenticated remote attackers can exploit the issue, and no user interaction is required.

What does exploitation require in practice?

An attacker sends long API request bodies that trigger excessive CPU use in the password-redaction regular expression during error handling. A small number of concurrent large requests can exhaust server workers.

What is the operational impact?

Exploitation can make EspoCRM slow or unavailable to legitimate users by exhausting server worker capacity.

GHSA-6pjq-v35w-jmjh: EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex

Event History

Frequently Asked Questions

Which deployments are affected?

Does an attacker need an account or user interaction?

What does exploitation require in practice?

What is the operational impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does an attacker need an account or user interaction?

What does exploitation require in practice?

What is the operational impact?