EspoCRM: Denial of service via inefficient password-redaction regex
Summary
EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a regular expression in its password-redaction logic that is used during API error handling. Long request bodies cause excessive CPU consumption. An unauthenticated remote attacker can send a small number of large API requests concurrently to exhaust server workers, making the CRM slow or unavailable for legitimate users.
Affected
- EspoCRM 10.0.0 to before 10.0.8
- EspoCRM before 9.3.11
- Versions 8.x and older: Unknown.
Fixed in
- EspoCRM 9.3.11
- EspoCRM 10.0.8 or later
Workaround
- No vendor workaround known.
- Until patched, limit request body size at the reverse proxy and restrict access to the CRM and its API from the internet. Verify these controls in your setup before relying on them.
Exploitation
- No known exploitation in the wild.
- No public proof of concept known.
- Not listed in the CISA KEV catalog.
Our recommendation
- Identify all EspoCRM instances and their exact versions.
- Upgrade to 9.3.11 or 10.0.8 or later.
- Until the upgrade, restrict external access and monitor for service degradation.
- Verify the version numbers against the vendor advisory before rollout.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-6pjq-v35w-jmjh github.com
- VulnCheck Advisory: EspoCRM password-redaction regex DoS www.vulncheck.com
- VulDB CVE-2026-118686 vuldb.com
- OffSeq threat radar entry radar.offseq.com
- TheHackerWire CVE-2026-118686 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:45.
Original description (NVD)
EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can concurrently send a small number of large API requests to exhaust server workers, making EspoCRM slow or unavailable to legitimate users.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.