CVE-2026-21868

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21868", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-05T16:44:16.368Z", "datePublished": "2026-01-08T00:26:46.668Z", "dateUpdated": "2026-01-08T19:06:16.315Z"}, "containers": {"cna": {"title": "Flag Forge has ReDoS Vulnerability in User Profile Lookup API", "problemTypes": [{"descriptions": [{"cweId": "CWE-1333", "lang": "en", "description": "CWE-1333: Inefficient Regular Expression Complexity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-949h-9824-xmcx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-949h-9824-xmcx"}], "affected": [{"vendor": "FlagForgeCTF", "product": "flagForge", "versions": [{"version": "< 2.3.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-08T00:26:46.668Z"}, "descriptions": [{"lang": "en", "value": "Flag Forge is a Capture The Flag (CTF) platform. Versions 2.3.2 and below have a Regular Expression Denial of Service (ReDoS) vulnerability in the user profile API endpoint (/api/user/[username]). The application constructs a regular expression dynamically using unescaped user input (the username parameter). An attacker can exploit this by sending a specially crafted username containing regex meta-characters (e.g., deeply nested groups or quantifiers), causing the MongoDB regex engine to consume excessive CPU resources. This can lead to Denial of Service for other users. The issue is fixed in version 2.3.3. To workaround this issue, implement a Web Application Firewall (WAF) rule to block requests containing regex meta-characters in the URL path."}], "source": {"advisory": "GHSA-949h-9824-xmcx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-08T19:06:07.519194Z", "id": "CVE-2026-21868", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T19:06:16.315Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21868", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-08T19:06:07.519194Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T19:06:12.384Z"}}], "cna": {"title": "Flag Forge has ReDoS Vulnerability in User Profile Lookup API", "source": {"advisory": "GHSA-949h-9824-xmcx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "FlagForgeCTF", "product": "flagForge", "versions": [{"status": "affected", "version": "< 2.3.3"}]}], "references": [{"url": "https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-949h-9824-xmcx", "name": "https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-949h-9824-xmcx", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Flag Forge is a Capture The Flag (CTF) platform. Versions 2.3.2 and below have a Regular Expression Denial of Service (ReDoS) vulnerability in the user profile API endpoint (/api/user/[username]). The application constructs a regular expression dynamically using unescaped user input (the username parameter). An attacker can exploit this by sending a specially crafted username containing regex meta-characters (e.g., deeply nested groups or quantifiers), causing the MongoDB regex engine to consume excessive CPU resources. This can lead to Denial of Service for other users. The issue is fixed in version 2.3.3. To workaround this issue, implement a Web Application Firewall (WAF) rule to block requests containing regex meta-characters in the URL path."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1333", "description": "CWE-1333: Inefficient Regular Expression Complexity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-08T00:26:46.668Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21868", "state": "PUBLISHED", "dateUpdated": "2026-01-08T19:06:16.315Z", "dateReserved": "2026-01-05T16:44:16.368Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-08T00:26:46.668Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "flagForge", "vendor": "FlagForgeCTF", "versions": [{"status": "affected", "version": "< 2.3.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:flagforge:flagforge:*:*:*:*:*:*:*:*", "matchCriteriaId": "FF98A9BF-17BE-4FBF-9D72-725005A165C8", "versionEndExcluding": "2.3.3", "versionStartIncluding": "2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Flag Forge is a Capture The Flag (CTF) platform. Versions 2.3.2 and below have a Regular Expression Denial of Service (ReDoS) vulnerability in the user profile API endpoint (/api/user/[username]). The application constructs a regular expression dynamically using unescaped user input (the username parameter). An attacker can exploit this by sending a specially crafted username containing regex meta-characters (e.g., deeply nested groups or quantifiers), causing the MongoDB regex engine to consume excessive CPU resources. This can lead to Denial of Service for other users. The issue is fixed in version 2.3.3. To workaround this issue, implement a Web Application Firewall (WAF) rule to block requests containing regex meta-characters in the URL path."}, {"lang": "es", "value": "Flag Forge es una plataforma de Capture The Flag (CTF). Las versiones 2.3.2 e inferiores tienen una vulnerabilidad de denegaci\u00f3n de servicio por expresi\u00f3n regular (ReDoS) en el endpoint de la API de perfil de usuario (/api/user/[username]). La aplicaci\u00f3n construye una expresi\u00f3n regular din\u00e1micamente utilizando entrada de usuario sin escapar (el par\u00e1metro username). Un atacante puede explotar esto enviando un nombre de usuario especialmente dise\u00f1ado que contenga metacaracteres de regex (p. ej., grupos anidados profundamente o cuantificadores), lo que provoca que el motor de regex de MongoDB consuma recursos excesivos de CPU. Esto puede llevar a la denegaci\u00f3n de servicio para otros usuarios. El problema est\u00e1 solucionado en la versi\u00f3n 2.3.3. Como soluci\u00f3n alternativa a este problema, implemente una regla de cortafuegos de aplicaciones web (WAF) para bloquear las solicitudes que contengan metacaracteres de regex en la ruta URL."}], "id": "CVE-2026-21868", "lastModified": "2026-06-17T10:19:03.550", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21868", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-08T19:06:07.519194Z", "version": "2.0.3"}}]}, "published": "2026-01-08T01:15:55.483", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-949h-9824-xmcx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1333"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T07:50:07.276231+00:00", "value": {"mitigation_remediation": ["Upgrade FlagForge to version 2.3.3 or later to eliminate the vulnerable regular\u2011expression construction.", "Configure a Web Application Firewall rule that rejects or blocks URLs containing regex meta\u2011characters such as parentheses, braces, or quantifiers before they reach the application.", "Implement input validation or sanitization for the username parameter, enforce a strict alphanumeric format, and consider rate limiting or monitoring CPU usage to detect abnormal regex processing during ongoing operations."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The affected product is FlagForge CTF: FlagForge. Any deployment running version 2.3.2 or earlier is vulnerable. The issue is fixed in version 2.3.3; older versions lack the remediation and are at risk.", "description_and_impact": "Flag\u202fForge versions 2.3.2 and below construct a regular expression directly from the username supplied to the user profile API endpoint. This dynamic, unescaped pattern allows an attacker to send a crafted username containing a large number of nested or quantified groups, causing the MongoDB regular\u2011expression engine to consume excessive CPU time. The resulting denial of service can degrade performance or bring the service to a halt for other users. The weakness is identified as CWE\u20111333, a regular expression denial of service.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity impact on availability. The EPSS score is <1%, suggesting that at the time of analysis the likelihood of exploitation is very low but non\u2011zero. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit it by sending a specially crafted HTTP request targeting the /api/user/[username] endpoint, where the [username] component contains regex meta\u2011characters. This request forces the server to perform an expensive pattern match, consuming CPU resources and potentially disrupting service for legitimate users."}}}}, "created": "2026-01-08T09:47:43.389052+00:00", "updated": "2026-04-18T08:00:05.786737+00:00", "vendors": ["flagforgectf", "flagforgectf$PRODUCT$flagforge"]}