GitHub Advisoryadvisory · PyPI

GHSA-qrpw-gjvh-x5gm Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)

MEDIUM Published 2026-05-13 Modified 2026-06-09 Official page ↗
Aliases
CVE-2026-44796
Ecosystem
PyPI
Packages
nautobot
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333, CWE-400
Reviewed
2026-05-13

Affected packages

• PyPI nautobot: >= 3.0.0a2, < 3.1.2 → fixed in 3.1.2 • PyPI nautobot: < 2.4.33 → fixed in 2.4.33

Description

Impact Nautobot UI object-bulk-rename endpoints (for example, `/dcim/interfaces/rename/`) were vulnerable to application-wide denial of service via maliciously crafted regular expressions in the `find` field in combination with the `use_regex` flag. Patches A general-purpose timeout has been added to these endpoints in Nautobot v2.4.33 and v3.1.2, which ensures that the request will fail early with an appropriate message if regular expression evaluation takes more than a short period of time, instead of continuing to execute for an indefinite duration. Workarounds No known workaround has been identified at this time. References • 2.4.33 (patch) • 3.1.2 (patch)

Related

Alias · CVE (1)

  • CVE-2026-44796 Nautobot is a Network Source of Truth and Network Automation Platform. vulnerability

Weakness · CWE (2)

  • CWE-1333 Inefficient Regular Expression Complexity weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References