CVE-2026-118686

CVSS 8.7 (high) · published 2026-10-28

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can concurrently send a small number of large API requests to exhaust server workers, making EspoCRM slow or unavailable to legitimate users.

Weakness: CWE-1333

Source: NVD CVE-2026-118686

References

• https://github.com/espocrm/espocrm/security/advisories/GHSA-6pjq-v35w-jmjh
• https://www.vulncheck.com/advisories/espocrm-before-9.3.11-and-10.0.8-unauthenticated-denial-of-service-via-password-redaction-regex

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.