CVE-2026-59966 Details
Description
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout when an authenticated user stores a catastrophic-backtracking regex and any user in the same Space imports a matching recipe. Request processing uses Automation.param_2, apply_regex_replace_automation, sub, api/recipe-from-source/. The attack works because the shared-Space automation engine evaluates the malicious pattern during recipe import and can occupy a Gunicorn worker until its request timeout. This can exhaust application worker slots and make the service unavailable to users. This issue is fixed in version 2.6.10.
A denial-of-service vulnerability has been identified in Tandoor Recipes versions prior to 2.6.10. The issue arises in the application's automation engine, which executes user-defined regular expression patterns using Python's re.sub() function. This execution lacks proper validation and can lead to catastrophic backtracking. When an authenticated user creates a malicious regex and another user in the same space imports a recipe, the regex is evaluated, potentially causing a Gunicorn worker to hang until it times out. This behavior can exhaust the application's worker slots, making the service unavailable to users.
Users can update to Tandoor Recipes version 2.6.10 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-f2gw-c2c7-59v7 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/TandoorRecipes/recipes/commit/adc2732712819d7fe26a9f74f6b0271c1a9d87c3 | [email protected] | Source CodeVendor |
| https://github.com/TandoorRecipes/recipes/releases/tag/2.6.10 | [email protected] | Release NotesVendor |
| https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-f2gw-c2c7-59v7 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tandoor Recipes | <= 2.6.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | New CVE Received | [email protected] |
| Oct 16, 2026 | CVE Modified | CISA-ADP |