Executive brief
Nautobot, a popular network source of truth and automation platform, is vulnerable to a denial-of-service attack. An attacker with basic user permissions can submit a specially crafted search pattern during bulk rename operations that causes the system to freeze or become unresponsive. This can disrupt network management operations and impact the availability of the platform for all users.
Technical details
A Regular Expression Denial of Service (REDoS) vulnerability exists in Nautobot's object-bulk-rename UI endpoints, such as `/dcim/interfaces/rename/`. The vulnerability is rooted in the `find` field when the `use_regex` flag is enabled, where inefficient regular expression complexity (CWE-1333) allows for uncontrolled resource consumption (CWE-400). An authenticated attacker with network access can provide a maliciously crafted regex that triggers catastrophic backtracking, consuming excessive CPU cycles and leading to an application-wide denial of service. The issue has been mitigated in versions 2.4.33 and 3.1.2 by implementing a general-purpose timeout for regex evaluation in these specific endpoints.
Affected products
- Nautobot Nautobot >= 3.0.0a2, < 3.1.2; < 2.4.33
Timeline
- 2026-05-08: disclosed: Initial disclosure by reporter
- 2026-05-13: advisory: GitHub Advisory published
- 2026-05-28: other: NVD publication date