CVE-2026-72912

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72912", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-10T17:57:26.143Z", "datePublished": "2026-08-10T21:02:16.375Z", "dateUpdated": "2026-08-12T22:14:24.757Z"}, "containers": {"cna": {"title": "CyberChef\u2019s pretty-recipe parser vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URL", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1333", "lang": "en", "description": "CWE-1333: Inefficient Regular Expression Complexity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/gchq/CyberChef/security/advisories/GHSA-w74r-jxjh-gwr6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gchq/CyberChef/security/advisories/GHSA-w74r-jxjh-gwr6"}, {"name": "https://github.com/gchq/CyberChef/pull/2687", "tags": ["x_refsource_MISC"], "url": "https://github.com/gchq/CyberChef/pull/2687"}, {"name": "https://github.com/gchq/CyberChef/commit/f77ddf489050b339faa978bb28da954bafd289ae", "tags": ["x_refsource_MISC"], "url": "https://github.com/gchq/CyberChef/commit/f77ddf489050b339faa978bb28da954bafd289ae"}, {"name": "https://github.com/gchq/CyberChef/releases/tag/v11.3.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/gchq/CyberChef/releases/tag/v11.3.0"}], "affected": [{"vendor": "gchq", "product": "CyberChef", "versions": [{"version": "< 11.3.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-10T21:02:16.375Z"}, "descriptions": [{"lang": "en", "value": "CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed #recipe= URL fragment containing a large number of unmatched quote characters reaches Utils.parseRecipeConfig(). The function synchronously applies a complex global regular expression that may perform heavy backtracking before rejecting the input, causing the victim's browser tab to freeze during startup for seconds or longer. No code execution, data exfiltration, or privilege escalation occurs. This issue is fixed in version 11.3.0."}], "source": {"advisory": "GHSA-w74r-jxjh-gwr6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T22:08:01.746436Z", "id": "CVE-2026-72912", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T22:14:24.757Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72912", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T22:08:01.746436Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T22:08:03.178Z"}}], "cna": {"title": "CyberChef\u2019s pretty-recipe parser vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URL", "source": {"advisory": "GHSA-w74r-jxjh-gwr6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "gchq", "product": "CyberChef", "versions": [{"status": "affected", "version": "< 11.3.0"}]}], "references": [{"url": "https://github.com/gchq/CyberChef/security/advisories/GHSA-w74r-jxjh-gwr6", "name": "https://github.com/gchq/CyberChef/security/advisories/GHSA-w74r-jxjh-gwr6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/gchq/CyberChef/pull/2687", "name": "https://github.com/gchq/CyberChef/pull/2687", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/gchq/CyberChef/commit/f77ddf489050b339faa978bb28da954bafd289ae", "name": "https://github.com/gchq/CyberChef/commit/f77ddf489050b339faa978bb28da954bafd289ae", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/gchq/CyberChef/releases/tag/v11.3.0", "name": "https://github.com/gchq/CyberChef/releases/tag/v11.3.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed #recipe= URL fragment containing a large number of unmatched quote characters reaches Utils.parseRecipeConfig(). The function synchronously applies a complex global regular expression that may perform heavy backtracking before rejecting the input, causing the victim's browser tab to freeze during startup for seconds or longer. No code execution, data exfiltration, or privilege escalation occurs. This issue is fixed in version 11.3.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1333", "description": "CWE-1333: Inefficient Regular Expression Complexity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-10T21:02:16.375Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72912", "state": "PUBLISHED", "dateUpdated": "2026-08-12T22:14:24.757Z", "dateReserved": "2026-08-10T17:57:26.143Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-10T21:02:16.375Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "CyberChef", "vendor": "gchq", "versions": [{"status": "affected", "version": "< 11.3.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed #recipe= URL fragment containing a large number of unmatched quote characters reaches Utils.parseRecipeConfig(). The function synchronously applies a complex global regular expression that may perform heavy backtracking before rejecting the input, causing the victim's browser tab to freeze during startup for seconds or longer. No code execution, data exfiltration, or privilege escalation occurs. This issue is fixed in version 11.3.0."}, {"lang": "es", "value": "CyberChef es una aplicaci\u00f3n web para cifrado, codificaci\u00f3n, compresi\u00f3n y an\u00e1lisis de datos. Antes de la versi\u00f3n 11.3.0, el analizador pretty-recipe de CyberChef en src/core/Utils.mjs puede agotar la CPU del lado del cliente cuando un fragmento de URL #recipe= malformado que contiene un gran n\u00famero de caracteres de comillas no coincidentes llega a Utils.parseRecipeConfig(). La funci\u00f3n aplica sincr\u00f3nicamente una expresi\u00f3n regular global compleja que puede realizar un retroceso intensivo antes de rechazar la entrada, lo que provoca que la pesta\u00f1a del navegador de la v\u00edctima se congele durante el inicio durante segundos o m\u00e1s. No se produce ejecuci\u00f3n de c\u00f3digo, exfiltraci\u00f3n de datos o escalada de privilegios. Este problema est\u00e1 solucionado en la versi\u00f3n 11.3.0."}], "id": "CVE-2026-72912", "lastModified": "2026-10-23T19:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72912", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-12T22:08:01.746436Z", "version": "2.0.3"}}]}, "published": "2026-08-10T21:17:26.130", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/gchq/CyberChef/commit/f77ddf489050b339faa978bb28da954bafd289ae"}, {"source": "security-advisories@github.com", "url": "https://github.com/gchq/CyberChef/pull/2687"}, {"source": "security-advisories@github.com", "url": "https://github.com/gchq/CyberChef/releases/tag/v11.3.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/gchq/CyberChef/security/advisories/GHSA-w74r-jxjh-gwr6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-1333"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,11.3.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "CyberChef", "source": "cna", "vendor": "gchq"}, "product": "cyberchef", "vendor": "gchq"}], "created": "2026-08-10T22:45:05.168131+00:00", "updated": "2026-08-11T02:30:17.105689+00:00", "vendors": ["gchq", "gchq$PRODUCT$cyberchef"]}