Summary
generated automatically from NVD dataEspoCRM has a denial of service flaw (CWE-1333) in its API error handling, where the regular expression that redacts passwords uses excessive CPU when processing long request bodies. An unauthenticated remote attacker can concurrently send a few large API requests to exhaust server workers, leaving EspoCRM slow or unavailable for legitimate users. The issue affects versions before 9.3.11 and 10.x before 10.0.8, and carries a CVSS v3.1 score of 7.5 (HIGH).
NVD description
EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can concurrently send a small number of large API requests to exhaust server workers, making EspoCRM slow or unavailable to legitimate users.
EPSS · FIRST.org
0.35%probability of exploitation in the next 30 days
Higher than 28% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-30, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 28 oct. 2026
- Updated
- 28 oct. 2026
- Status
- Deferred
- Source
- disclosure@vulncheck.com
Weaknesses (CWE)
Similar CVEs
Other vulnerabilities of type CWE-1333
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.