EspoCRM CVE-2026-118686

No special conditions beyond reachability - remote unauthenticated exploitation against default configurations of EspoCRM (versions <=10.0.7 and <=9.3.10), since AV:N/AC:L/AT:N/PR:N/UI:N and the vulnerable password-redaction regex runs automatically in the API error-handling path. The concrete trigger is sending large API request bodies that reach that error-handling redaction regex; the described amplification requires a small number of such requests sent concurrently to exhaust server workers. Limiting factors: impact is confined to availability (no confidentiality or integrity loss, no scope change to other systems), and effectiveness depends on sustaining enough concurrent large requests to saturate the worker pool rather than a single packet.

This is a moderate-priority availability issue, not a critical system-compromise flaw, despite the elevated 8.7 CVSS 4.0 score. The supplied vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-reachable, unauthenticated, no-interaction, low-complexity exploitation, which is what drives the high number - but impact is strictly availability (VA:H, with VC:N/VI:N/VA confined to the one system and SC/SI/SA:N), so there is no data disclosure, integrity loss, or code execution. CWE-1333 (inefficient regular expression complexity / ReDoS) matches the description: the password-redaction regex applied during API error handling burns CPU on long bodies, letting a few large concurrent requests exhaust workers. Signals are mostly consistent: the GHSA advisory and the VulnCheck NVD-linked advisory corroborate the unauthenticated DoS, and the vuln.today Decision label is 'this_week' (not act_now/emergency). Contrasting the signals: there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active exploitation or a quantified exploitation probability - treat exploitation likelihood as unassessed rather than low. The only exploit artifact is a PoC reference (the vendor advisory itself), not verified working exploit code, so weaponization cannot be assumed. Net: a genuine, easily-triggered availability risk worth patching on a normal-but-prompt cycle, weighted down by availability-only impact and the absence of confirmed in-the-wild use.

An unauthenticated attacker sends a small number of concurrent API requests with very large bodies that trigger EspoCRM's error-handling path, where the password-redaction regular expression runs against the oversized input and consumes excessive CPU. The combined load exhausts the available server workers, degrading or denying service to legitimate users. A public PoC reference exists (the GHSA advisory); it is not verified as working exploit code.