PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44796 nautobot CVE debrief

Nautobot, a Network Source of Truth and Network Automation Platform, contains a denial-of-service vulnerability in its UI object-bulk-rename endpoints (e.g., /dcim/interfaces/rename/). Prior to versions 2.4.33 and 3.1.2, authenticated users with access to these endpoints could trigger application-wide DoS by submitting maliciously crafted regular expressions in the find field when the use_regex flag is enabled. The vulnerability stems from unbounded regular expression evaluation (ReDoS), classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-1333 (Inefficient Regular Expression Complexity). The CVSS 3.1 score of 6.5 (Medium) reflects network attack vector, low attack complexity, required low privileges, no user interaction, and high availability impact. Fixes were released on May 28, 2026, with commits 5a30d091 and c2b7669 addressing the regex handling.

Vendor
nautobot
Product
Unknown
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations running Nautobot instances for network automation and documentation, particularly those with multi-user environments where non-administrative users have access to bulk editing features. Security teams should prioritize patching due to the low barrier to exploitation and high availability impact.

Technical summary

The vulnerability exists in Nautobot's UI object-bulk-rename functionality where user-supplied regular expressions in the find field are evaluated without proper safeguards against catastrophic backtracking. When use_regex is enabled, a maliciously crafted pattern such as one with nested quantifiers (e.g., (a+)+) can cause exponential execution time, consuming excessive CPU resources and rendering the application unresponsive for all users. The attack requires low-privileged authenticated access and can be executed remotely without user interaction. The fix implements proper regex validation and/or timeout mechanisms to prevent unbounded execution.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Nautobot to version 2.4.33 or 3.1.2 or later
  • If immediate patching is not feasible, restrict access to bulk-rename endpoints to trusted administrative users only
  • Monitor application performance for unusual CPU consumption patterns that may indicate ReDoS exploitation attempts
  • Review web server and application logs for suspicious regex patterns in rename operations
  • Consider implementing input validation or rate limiting on bulk-rename functionality as a temporary mitigation

Evidence notes

Vulnerability confirmed via GitHub Security Advisory GHSA-qrpw-gjvh-x5gm. Fix commits and release tags verified. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. Weaknesses: CWE-400, CWE-1333.

Official resources

2026-05-28