CVE-2026-27460 TandoorRecipes CVE debrief

Who should care

Defenders responsible for Tandoor Recipes deployments should assess exposure and apply the patch. System administrators and security teams managing recipe management applications should verify if vulnerable versions are in use and prioritize remediation.

Why it matters

CVE-2026-27460 is a critical DoS vulnerability in Tandoor Recipes that allows authenticated users to crash the server or degrade performance. Defenders should verify exposure, apply the patch, and monitor for potential abuse.

• Potential server crashes or significant performance degradation.
• Increased risk of service disruption by authenticated users.
• Need for verification of current version and potential patch application.
• Potential for increased monitoring and logging to detect abuse.

Technical summary

The Tandoor Recipes application, prior to version 2.6.5, contains a critical Denial of Service (DoS) vulnerability in its recipe import functionality. An authenticated user can cause the server to crash or significantly degrade its performance by uploading a large ZIP file (ZIP Bomb). The vulnerability allows an authenticated user to cause a DoS, which can lead to potential server crashes or significant performance degradation. This issue is fixed in version 2.6.5 of Tandoor Recipes. Defenders should prioritize verifying exposure and applying the patch.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability allows an authenticated user to cause a DoS.

Recommended defensive actions

• Verify if the Tandoor Recipes application is running on your systems and if it is vulnerable (i.e., version < 2.6.5).
• Apply the patch by updating to version 2.6.5 or later.
• Monitor server performance and logs for potential abuse by authenticated users.
• Consider implementing additional security measures to restrict authenticated user actions.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is described in the CVE record and NVD entry. The fix is noted in version 2.6.5 of Tandoor Recipes. Evidence is limited to public CVE and NVD sources. Defenders should verify current version and potential patch application with explicit evidence limits. The CVE record was published on 2026-04-10T19:16:21.427Z and has not been modified since then. No additional evidence is available beyond CVE and NVD entries.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.