Which versions of GROWI are affected by EUVD-2026-25199?

GROWI collaboration platform contains a remote denial of service vulnerability (CVE-2026-41040, CVSS 8.7) that allows unauthenticated attackers to crash or degrade service availability by submitting…

How to fix or mitigate EUVD-2026-25199?

Within 24 hours: Inventory all GROWI instances and document current versions in use; contact GROWI, Inc. for patch availability timeline and interim workarounds. Within 7 days: Implement network-level rate limiting or request filtering on GROWI endpoints to reduce ReDoS attack surface; consider temporarily restricting external network access if business operations permit. Within 30 days: Apply vendor-released patch to all GROWI instances immediately upon availability; validate patch deployment and monitor for service stability.

GROWI EUVD-2026-25199

Q: What is the CVSS score of EUVD-2026-25199?

EUVD-2026-25199 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-41040 HIGH

Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)

2026-04-23 jpcert

GHSA-vjmw-64m9-xqq5

Denial Of Service Growi

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 14:52 vuln.today

cvss_changed

Analysis Generated

Apr 23, 2026 - 08:00 vuln.today

CVSS changed

Apr 23, 2026 - 07:35 NVD

7.5 (HIGH) 8.7 (HIGH)

EUVD ID Assigned

Apr 23, 2026 - 07:30 euvd

EUVD-2026-25199

Analysis Generated

Apr 23, 2026 - 07:30 vuln.today

CVE Published

Apr 23, 2026 - 06:59 nvd

HIGH 8.7

DescriptionCVE.org

GROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via a crafted input string.

AnalysisAI

Remote denial of service via regular expression attack in GROWI allows unauthenticated network attackers to exhaust server resources by submitting maliciously crafted input strings that trigger catastrophic backtracking in regex processing (CWE-1333). GROWI, Inc.'s collaboration platform is vulnerable to ReDoS with a CVSS 4.0 base score of 8.7 (High), reflecting high availability impact through network-accessible, low-complexity exploitation requiring no privileges or user interaction. No CISA KEV listing or public exploit code identified at time of analysis, though vendor advisory confirms the vulnerability and provides remediation guidance.

Technical ContextAI

GROWI is a team collaboration and wiki platform developed by GROWI, Inc., commonly deployed for knowledge management and documentation. Regular Expression Denial of Service (ReDoS/CWE-1333) occurs when poorly optimized regular expressions exhibit catastrophic backtracking behavior on specially crafted input. When a regex contains nested quantifiers or overlapping patterns (e.g., (a+)+, (a|a)*, (a*)*), the regex engine may enter exponential time complexity when matching against adversarial input, consuming excessive CPU cycles and potentially blocking event loops or thread pools. In Node.js-based applications like GROWI, ReDoS attacks can freeze the main thread, preventing the server from processing legitimate requests. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates the vulnerable regex processing occurs on network-reachable endpoints without requiring authentication, making this a high-exposure attack surface.

RemediationAI

Apply the vendor-released patch as specified in GROWI's official security advisory at https://growi.co.jp/news/44/. Upgrade to the patched GROWI version identified in the advisory-exact fix version should be verified from vendor documentation as NVD data does not specify the remediated release. If immediate patching is not feasible, implement rate limiting and request size restrictions on input endpoints to reduce ReDoS impact: configure reverse proxies (nginx, Apache) with client_body_timeout and send_timeout directives to terminate slow requests (trade-off: may impact legitimate users on slow connections), deploy Web Application Firewall rules to detect and block repetitive pattern submissions (trade-off: requires pattern tuning to avoid false positives), and apply per-IP connection limits to prevent single-source exhaustion attacks (trade-off: ineffective against distributed attacks). These compensating controls mitigate but do not eliminate the vulnerability. Monitor application server CPU usage and response times for anomalous spikes indicating active exploitation attempts.