{"schema":"threatline.record/2","record":{"id":"CVE-2026-59966","aliases":["GHSA-f2gw-c2c7-59v7"],"summary":"Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns","details":"Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout when an authenticated user stores a catastrophic-backtracking regex and any user in the same Space imports a matching recipe. Request processing uses Automation.param_2, apply_regex_replace_automation, sub, api/recipe-from-source/. The attack works because the shared-Space automation engine evaluates the malicious pattern during recipe import and can occupy a Gunicorn worker until its request timeout. This can exhaust application worker slots and make the service unavailable to users. This issue is fixed in version 2.6.10.","categories":["Unclassified"],"product":"recipes","vendor":"TandoorRecipes","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-59966","source_modified_at":"2026-10-16T19:40:13.402Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"recipes","vendor":"TandoorRecipes","versions":[{"version":"< 2.6.10","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":5.7,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00319,"percentile":0.23627,"score_date":"2026-10-23"},"published_at":"2026-10-16T19:18:57.453Z","modified_at":"2026-10-16T19:40:13.402Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-59966","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-16T19:40:13.402Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-59966","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-f2gw-c2c7-59v7","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/TandoorRecipes/recipes/commit/adc2732712819d7fe26a9f74f6b0271c1a9d87c3","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/TandoorRecipes/recipes/releases/tag/2.6.10","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-16T19:39:45.918792Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-16T19:40:13.402Z","content_hash":"3d0c5a1924764974f1b4ef484a8388af7ec49df2dad48739b2de991ef9eb1313"}}