PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44796 nautobot CVE debrief

Nautobot, a Network Source of Truth and Network Automation Platform, contains a denial-of-service vulnerability in its UI object-bulk-rename endpoints (e.g., /dcim/interfaces/rename/). Prior to versions 2.4.33 and 3.1.2, authenticated users with access to these endpoints could trigger application-wide DoS by submitting maliciously crafted regular expressions in the find field when the use_regex flag is enabled. The vulnerability stems from unbounded regular expression evaluation (ReDoS), classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-1333 (Inefficient Regular Expression Complexity). The CVSS 3.1 score of 6.5 (Medium) reflects network attack vector, low attack complexity, required low privileges, no user interaction, and high availability impact. Fixes were released on May 28, 2026, with commits 5a30d091 and c2b7669 addressing the regex handling.

Vendor
nautobot
Product
Unknown
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations running Nautobot instances for network automation and documentation, particularly those with multi-user environments where non-administrative users have access to bulk editing features. Security teams should prioritize patching due to the low barrier to exploitation and high availability impact.

Technical summary

The vulnerability exists in Nautobot's UI object-bulk-rename functionality where user-supplied regular expressions in the find field are evaluated without proper safeguards against catastrophic backtracking. When use_regex is enabled, a maliciously crafted pattern such as one with nested quantifiers (e.g., (a+)+) can cause exponential execution time, consuming excessive CPU resources and rendering the application unresponsive for all users. The attack requires low-privileged authenticated access and can be executed remotely without user interaction. The fix implements proper regex validation and/or timeout mechanisms to prevent unbounded execution.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Nautobot to version 2.4.33 or 3.1.2 or later
  • If immediate patching is not feasible, restrict access to bulk-rename endpoints to trusted administrative users only
  • Monitor application performance for unusual CPU consumption patterns that may indicate ReDoS exploitation attempts
  • Review web server and application logs for suspicious regex patterns in rename operations
  • Consider implementing input validation or rate limiting on bulk-rename functionality as a temporary mitigation

Evidence notes

Vulnerability confirmed via GitHub Security Advisory GHSA-qrpw-gjvh-x5gm. Fix commits and release tags verified. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. Weaknesses: CWE-400, CWE-1333.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44796 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44796

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44796 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44796

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.