CVE-2026-118686GHSA-6pjq-v35w-jmjh

EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex

espocrm espocrm

Open in Threatline Record JSON

CVSS

8.7High

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet

Fixed in10.0.8Also 9.3.11CVE List

Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

10.0.8espocrmCVE List
9.3.11espocrmCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

@thehackerwire.bsky.social: 🟠 CVE-2026-118686 - High (7.5) EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which ... https://www.thehackerwire.com/vulnerability/CVE-Bluesky: CVE posts, 28 Oct 2026

Description

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can concurrently send a small number of large API requests to exhaust server workers, making EspoCRM slow or unavailable to legitimate users.

Text from CVE List

Affected versions 4

espocrmaffected: 10.0.0 before 10.0.8CVE List
espocrmunaffected: 10.0.8CVE List
espocrmaffected: all versions before 9.3.11CVE List
espocrmunaffected: 9.3.11CVE List