GHSA-qrpw-gjvh-x5gm

Source

https://github.com/advisories/GHSA-qrpw-gjvh-x5gm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-qrpw-gjvh-x5gm/GHSA-qrpw-gjvh-x5gm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qrpw-gjvh-x5gm

Aliases

Published

2026-05-13T15:30:53Z

Modified

2026-07-13T07:26:36Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)

Details

Impact

Nautobot UI object-bulk-rename endpoints (for example, /dcim/interfaces/rename/) were vulnerable to application-wide denial of service via maliciously crafted regular expressions in the find field in combination with the use_regex flag.

Patches

A general-purpose timeout has been added to these endpoints in Nautobot v2.4.33 and v3.1.2, which ensures that the request will fail early with an appropriate message if regular expression evaluation takes more than a short period of time, instead of continuing to execute for an indefinite duration.

Workarounds

No known workaround has been identified at this time.

References

2.4.33 (patch)
3.1.2 (patch)

Database specific

{
    "cwe_ids":  [
        "CWE-1333",
        "CWE-400"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-13T15:30:53Z",
    "nvd_published_at":  "2026-05-28T18:16:33Z",
    "severity":  "MODERATE"
}

References

Affected packages

PyPI / nautobot

Package

Name: nautobot; View open source insights on deps.dev
Purl: pkg:pypi/nautobot

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.0.0a2

Fixed

3.1.2

Affected versions

3.*

3.0.0a2

3.0.0a3

3.0.0rc1

3.0.0rc2

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.8

3.0.9

3.0.10

3.0.11

3.1.0a1

3.1.0a2

3.1.0a3

3.1.0a4

3.1.0a5

3.1.0

3.1.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-qrpw-gjvh-x5gm/GHSA-qrpw-gjvh-x5gm.json"

PyPI / nautobot

Package

Name: nautobot; View open source insights on deps.dev
Purl: pkg:pypi/nautobot

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.4.33

Affected versions

1.*

1.0.0a1

1.0.0a2

1.0.0b1

1.0.0b2

1.0.0b3

1.0.0b4

1.0.0

1.0.1

1.0.2

1.0.3

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.2.8

1.2.9

1.2.10

1.2.11

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.3.8

1.3.9

1.3.10

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.7

1.4.8

1.4.9

1.4.10

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

1.5.8

1.5.9

1.5.10

1.5.11

1.5.12

1.5.13

1.5.14

1.5.15

1.5.16

1.5.17

1.5.18

1.5.19

1.5.20

1.5.21

1.5.22

1.5.23

1.5.24

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

1.6.8

1.6.9

1.6.10

1.6.11

1.6.12

1.6.13

1.6.14

1.6.15

1.6.16

1.6.17

1.6.18

1.6.19

1.6.20

1.6.21

1.6.22

1.6.23

1.6.24

1.6.25

1.6.26

1.6.27

1.6.28

1.6.29

1.6.30

1.6.31

1.6.32

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.1.0b1

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

2.1.8

2.1.9

2.2.0b1

2.2.0

2.2.1

2.2.2

2.2.3

2.2.4

2.2.5

2.2.6

2.2.7

2.2.8

2.2.9

2.3.0b1

2.3.0

2.3.1

2.3.2

2.3.3

2.3.4

2.3.5

2.3.6

2.3.7

2.3.8

2.3.9

2.3.10

2.3.11

2.3.12

2.3.13

2.3.14

2.3.15b1

2.3.15

2.3.16

2.4.0b1

2.4.0

2.4.1

2.4.2

2.4.3

2.4.4

2.4.5

2.4.6

2.4.7

2.4.8

2.4.9

2.4.10

2.4.11

2.4.12

2.4.13

2.4.14

2.4.15

2.4.16

2.4.17

2.4.18

2.4.19

2.4.20

2.4.21

2.4.22

2.4.23

2.4.24

2.4.25

2.4.26

2.4.27

2.4.28

2.4.29

2.4.30

2.4.31

2.4.32

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-qrpw-gjvh-x5gm/GHSA-qrpw-gjvh-x5gm.json"