CVE-2026-118686

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 9.3.11 EspoCRM versions prior to 10.0.8

Description An issue exists where the password-redaction regular expression used during API error handling consumes excessive CPU resources when processing long request bodies. Unauthenticated remote attackers can send a small number of large API requests concurrently to exhaust server workers, resulting in a denial of service that makes the system slow or unavailable to legitimate users.

Recommendations Update to version 9.3.11 or later. Update to version 10.0.8 or later.