Every CVE Search/ Get API key

CVE-2026-44796

Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)

6.5 MediumFix available

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot UI object-bulk-rename endpoints (for example, /dcim/interfaces/rename/) were vulnerable to application-wide denial of service via maliciously crafted regular expressions in the find field in combination with the use_regex flag. This vulnerability is fixed in 2.4.33 and 3.1.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.31%Up 0.3 points since May 29, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot UI object-bulk-rename endpoints (for example, /dcim/interfaces/rename/) were vulnerable to application-wide denial of service via maliciously crafted regular expressions in the find field in combination with the use_regex flag. This vulnerability is fixed in 2.4.33 and 3.1.2.

Record
CVE-2026-44796
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-1333
Updated
2026-11-02
EUVDEUVD-2026-32975 6.5

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot UI object-bulk-rename endpoints (for example, /dcim/interfaces/rename/) were vulnerable to application-wide denial of service via maliciously crafted regular expressions in the find field in combination with the use_regex flag. This vulnerability is fixed in 2.4.33 and 3.1.2.

Record
EUVD-2026-32975
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-qrpw-gjvh-x5gm 6.5

Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)

Impact

Nautobot UI object-bulk-rename endpoints (for example, /dcim/interfaces/rename/) were vulnerable to application-wide denial of service via maliciously crafted regular expressions in the find field in combination with the use_regex flag.

Patches

A general-purpose timeout has been added to these endpoints in Nautobot v2.4.33 and v3.1.2, which ensures that the request will fail early with an appropriate message if regular expression evaluation takes more than a short period of time, instead of continuing to execute for an indefinite duration.

Workarounds

No known workaround has been identified at this time.

References

  • 2.4.33 (<a href="https://github.com/nautobot/nautobot/commit/c2b766966d814a7141f62c7bc90c85fefb7892ee">patch</a>)
  • 3.1.2 (<a href="https://github.com/nautobot/nautobot/commit/5a30d0916953afbeedd24a784709e762cc3879cd">patch</a>)
Record
GHSA-qrpw-gjvh-x5gm
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-1333
Updated
2026-11-02
NVD 6.5

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot UI object-bulk-rename endpoints (for example, /dcim/interfaces/rename/) were vulnerable to application-wide denial of service via maliciously crafted regular expressions in the find field in combination with the use_regex flag. This vulnerability is fixed in 2.4.33 and 3.1.2.

Record
CVE-2026-44796
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-1333
Updated
2026-11-02
OSV 6.5

Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot UI object-bulk-rename endpoints (for example, /dcim/interfaces/rename/) were vulnerable to application-wide denial of service via maliciously crafted regular expressions in the find field in combination with the use_regex flag. This vulnerability is fixed in 2.4.33 and 3.1.2.

Record
CVE-2026-44796
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333, CWE-400
Updated
2026-11-02
OSVGHSA-qrpw-gjvh-x5gm 6.5

Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)

Impact

Nautobot UI object-bulk-rename endpoints (for example, /dcim/interfaces/rename/) were vulnerable to application-wide denial of service via maliciously crafted regular expressions in the find field in combination with the use_regex flag.

Patches

A general-purpose timeout has been added to these endpoints in Nautobot v2.4.33 and v3.1.2, which ensures that the request will fail early with an appropriate message if regular expression evaluation takes more than a short period of time, instead of continuing to execute for an indefinite duration.

Workarounds

No known workaround has been identified at this time.

References

  • 2.4.33 (<a href="https://github.com/nautobot/nautobot/commit/c2b766966d814a7141f62c7bc90c85fefb7892ee">patch</a>)
  • 3.1.2 (<a href="https://github.com/nautobot/nautobot/commit/5a30d0916953afbeedd24a784709e762cc3879cd">patch</a>)
Record
GHSA-qrpw-gjvh-x5gm
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-1333, CWE-400
Updated
2026-11-02
OSVPYSEC-2026-2226 6.5

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot UI object-bulk-rename endpoints (for example, /dcim/interfaces/rename/) were vulnerable to application-wide denial of service via maliciously crafted regular expressions in the find field in combination with the use_regex flag. This vulnerability is fixed in 2.4.33 and 3.1.2.

Record
PYSEC-2026-2226
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nautobot
PyPI
 3.0.0a2 up to 3.1.2
3.1.2
nautobot
PyPI
 before 2.4.33
2.4.33
nautobot
PyPI
 3.0.0a2 up to 3.1.2, plus listed versions
3.0.03.0.0a33.0.0rc13.0.0rc23.0.1
Show 17 moreShow less
3.0.103.0.113.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.0a13.1.0a23.1.0a33.1.0a43.1.0a53.1.1
3.1.2
nautobot
PyPI
 before 2.4.33, plus listed versions
1.0.01.0.0a11.0.0a21.0.0b11.0.0b2
Show 45 moreShow less
1.0.0b31.0.0b41.0.11.0.21.0.31.1.01.1.11.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.71.4.81.4.9
2.4.33
nautobot
PyPI
 before 2.4.33, 3.0.0 up to 3.1.2, plus listed versions
1.0.01.0.0a11.0.0a21.0.0b11.0.0b2
Show 45 moreShow less
1.0.0b31.0.0b41.0.11.0.21.0.31.1.01.1.11.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.101.2.111.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.01.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.101.4.21.4.31.4.41.4.51.4.71.4.81.4.9
2.4.333.1.2

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-44796 is a medium vulnerability (CVSS 6.5) in Nautobot, published May 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in nautobot 3.1.2.

References

This page doesn't list everything

Left out here: 298 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open