high7.5
CVE-2026-118686
EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API e…
Impact
EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can concurrently send a small number of large API requests to exhaust server workers, making EspoCRM slow or unavailable to legitimate users.
Affected products
| Product | Affected versions |
|---|---|
| EspoCRM | before 9.3.11 |
| 10.X | before 10.0.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.