Nautobot CVE-2026-44796

This is a CWE-400 (Uncontrolled Resource Consumption) vulnerability rooted in Python's built-in re module's susceptibility to catastrophic backtracking - a class of attack known as REDoS (Regular Expression Denial of Service). The affected package is pkg:pip/nautobot. The bulk-rename views (BulkRenameView and ObjectBulkRenameViewMixin) passed the user-supplied find field regex directly to re.sub() against each selected object's .name string, with no complexity limit, timeout, or pre-validation. A carefully constructed regex such as (a+)+$ combined with a near-match input string causes evaluation time to grow exponentially, blocking the application worker thread or process for an indefinite duration. The fix introduces signal.SIGALRM-based timeout enforcement in the rename views and promotes the regex>=2026.4.4 package from a development-only dependency to a production dependency, enabling safer regex evaluation. Additionally, bespoke bulk_rename actions on ModuleBayUIViewSet and ModuleBayTemplateUIViewSet were consolidated into the generic ObjectBulkRenameViewMixin to ensure consistent protection across all affected endpoints.