Description
EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can concurrently send a small number of large API requests to exhaust server workers, making EspoCRM slow or unavailable to legitimate users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| espocrm | espocrm | 10.0.0 – < 10.0.8, < 9.3.11 | 10.0.8 |