CVE-2026-4926

{"id": "CVE-2026-4926", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2026-03-26T19:17:08.387", "references": [{"url": "https://cna.openjsf.org/security-advisories.html", "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "Impact:\n\nA bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service.\n\nPatches:\n\nFixed in version 8.4.0.\n\nWorkarounds:\n\nLimit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns."}, {"lang": "es", "value": "Impacto:\n\nSe genera una expresi\u00f3n regular defectuosa siempre que se tienen m\u00faltiples grupos opcionales secuenciales (sintaxis de llaves), como `{a}{b}{c}:z`. La expresi\u00f3n regular generada crece exponencialmente con el n\u00famero de grupos, causando denegaci\u00f3n de servicio.\n\nParches:\n\nCorregido en la versi\u00f3n 8.4.0.\n\nSoluciones alternativas:\n\nLimitar el n\u00famero de grupos opcionales secuenciales en los patrones de ruta. Evitar pasar entradas controladas por el usuario como patrones de ruta."}], "lastModified": "2026-03-30T13:26:50.827", "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb"}