Sync-in Server CVE-2026-58270

Requires an authenticated Sync-in Server account (PR:L) with access to the sync diff endpoint, which accepts a user-supplied string and compiles it into a RegExp with no complexity validation. No user interaction and no special non-default configuration are needed beyond reaching that endpoint. A single crafted catastrophic-backtracking pattern (e.g. ^(a+)+b) blocks the shared Node.js event loop, so the limiting factors are: valid authentication is mandatory, and impact is a whole-instance denial of service persisting until the container is manually restarted.

This is a genuine but moderate-priority availability risk, not an inflated high-CVSS issue. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) is internally consistent with the description: a single authenticated user sends one crafted regex to the sync diff endpoint and blocks the Node.js single-threaded event loop, denying service to all users until the container is restarted - a classic ReDoS (CWE-1333). Impact is confined to availability (C:N/I:N), so there is no data exposure or code execution. No EPSS score, CISA KEV entry, or public POC is provided in the input, so per available signals this is 'no public exploit identified at time of analysis' - though the canonical trigger pattern (^(a+)+b) is trivially reproducible and named in the advisory itself, lowering the practical barrier. The main mitigating factor is that PR:L requires a valid authenticated account, so exploitation is limited to insiders or attackers who have already obtained credentials, and the blast radius is a self-hosted single instance rather than a fleet. No signals conflict; the vector and description align.

An authenticated user (or an attacker with stolen/low-privilege credentials) submits a catastrophic-backtracking regular expression such as ^(a+)+b to the sync diff endpoint, which compiles it into a RegExp without complexity validation. The regex engine spins on a pathological input, blocking the Node.js event loop and rendering the entire server unresponsive to every user until the container is manually restarted. No public exploit code is identified, but the trigger pattern is disclosed in the advisory and trivially reproducible.