EUVD-2026-33820
GHSA-95f6-rfpg-c3w8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in Enderfga claw-orchestrator up to 3.7.0. The impacted element is the function validateRegex of the file claw-orchestrator/src/embedded-server.ts of the component Session Grep Endpoint. The manipulation of the argument body.pattern leads to inefficient regular expression complexity. The attack may be initiated remotely. Upgrading to version 3.7.1 is sufficient to resolve this issue. The identifier of the patch is 3f970a974c65a94555c25af9f2796f11315e4584. It is recommended to upgrade the affected component.
AnalysisAI
Regular expression denial of service in Enderfga claw-orchestrator 3.7.0 and earlier allows authenticated remote attackers to degrade service availability by submitting crafted patterns to the Session Grep Endpoint. The validateRegex function in claw-orchestrator/src/embedded-server.ts passes user-supplied body.pattern directly to the V8 JavaScript regex engine, which uses backtracking and can be forced into exponential-time evaluation via patterns like (a+)+$. No public exploit is identified at time of analysis, and the CVSS score of 4.3 (A:L) reflects limited - but real - availability impact via Node.js event loop exhaustion.
Technical ContextAI
claw-orchestrator is a Node.js orchestration server (CPE: cpe:2.3:a:enderfga:claw-orchestrator:*:*:*:*:*:*:*:*). The /session/grep endpoint and session-grep tool accept a user-supplied regex pattern and compile it using the V8 JavaScript engine's built-in RegExp implementation, which employs a backtracking NFA and has worst-case exponential time complexity for certain pattern classes. CWE-1333 (Inefficient Regular Expression Complexity) covers this root cause: the application fails to constrain or sanitize regex patterns before evaluation, making it susceptible to ReDoS. Because Node.js is single-threaded, a blocked event loop during regex evaluation prevents any concurrent request processing, causing effective denial of service. The fix (commit 3f970a974c65a94555c25af9f2796f11315e4584, released in v3.7.1) replaces V8 regex compilation with the RE2 library (node-re2 ^1.24.0), which guarantees linear-time evaluation by using a DFA-based engine that never backtracks. A side effect of this change is that PCRE-only features - lookbehind assertions and backreferences - are now rejected at compile time with an 'Invalid regex pattern' error.
RemediationAI
Upgrade to claw-orchestrator v3.7.1, released 2026-05-11, which is the vendor-confirmed patched release available at https://github.com/Enderfga/claw-orchestrator/releases/tag/v3.7.1. The fix (commit 3f970a974c65a94555c25af9f2796f11315e4584) replaces V8 regex evaluation with RE2, guaranteeing linear-time processing. Note that v3.7.1 introduces a behavioral change: regex patterns relying on PCRE-only features such as lookbehind assertions or backreferences will be rejected at compile time - existing automation or user queries using such patterns must be updated. If immediate upgrade is not possible, restrict authenticated access to the /session/grep endpoint and session-grep tool to trusted administrative roles only, thereby reducing the population of users who can submit arbitrary patterns. Network-level controls blocking access to the grep endpoint are an additional compensating measure but may disrupt legitimate use of the grep functionality.
More in Claw Orchestrator
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today