Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)
Impact
Nautobot UI object-bulk-rename endpoints (for example, /dcim/interfaces/rename/) were vulnerable to application-wide denial of service via maliciously crafted regular expressions in the find field in combination with the use_regex flag.
Patches
A general-purpose timeout has been added to these endpoints in Nautobot v2.4.33 and v3.1.2, which ensures that the request will fail early with an appropriate message if regular expression evaluation takes more than a short period of time, instead of continuing to execute for an indefinite duration.
Workarounds
No known workaround has been identified at this time.
References
- 2.4.33 (<a href="https://github.com/nautobot/nautobot/commit/c2b766966d814a7141f62c7bc90c85fefb7892ee">patch</a>)
- 3.1.2 (<a href="https://github.com/nautobot/nautobot/commit/5a30d0916953afbeedd24a784709e762cc3879cd">patch</a>)
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | nautobot | >= 3.0.0a2, < 3.1.2, < 2.4.33 | 3.1.2, 2.4.33 |
References
- https://github.com/nautobot/nautobot/releases/tag/v2.4.33
- https://github.com/nautobot/nautobot/releases/tag/v3.1.2
- https://github.com/nautobot/nautobot/commit/5a30d0916953afbeedd24a784709e762cc3879cd
- https://github.com/nautobot/nautobot/commit/c2b766966d814a7141f62c7bc90c85fefb7892ee
- https://github.com/nautobot/nautobot/security/advisories/GHSA-qrpw-gjvh-x5gm
- https://nvd.nist.gov/vuln/detail/CVE-2026-44796
- https://github.com/nautobot/nautobot
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-1333, CWE-400- Platform
- Python (PyPI)
- Package
nautobot- Disclosed
- 13.05.2026
- Updated
- 11.10.2026 14:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-2226 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-qrpw-gjvh-x5gm - CC BY 4.0
Vulnerability history: nautobot
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 19
- First → latest
- 02.2023 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 9
- Medium 6
- Low 4
Disclosures per year
- 2023: 5
- 2024: 5
- 2025: 2
- 2026: 7
-
Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS) this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.