High severity · published Oct 28, 2026
CVE-2026-118686
EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex
New
7.5
CVSS
–
EPSS
No
On KEV
Description
EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can concurrently send a small number of large API requests to exhaust server workers, making EspoCRM slow or unavailable to legitimate users.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
espocrm · espocrm
10.0.0 before 10.0.8; before 9.3.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118686
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118686
vendor-advisory
https://github.com/espocrm/espocrm/security/advisories/GHSA-6pjq-v35w-jmjh
third-party-advisory
https://www.vulncheck.com/advisories/espocrm-before-9.3.11-and-10.0.8-unauthenticated-denial-of-service-via-password-redaction-regex
More from espocrm
9.1
CVE-2026-47168
EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params
9.1
CVE-2026-33656
EspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin user
8.8
CVE-2022-38843
EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server
8.8
CVE-2019-14351
EspoCRM 5.6.4 is vulnerable to user password hash enumeration
8.5
CVE-2025-32390
EspoCRM vulnerable to HTML Injection into phishing, which may lead to account takeover