CVE-2026-72912

Received Received - Intake

ReDoS in CyberChef via Malformed Recipe URL

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed #recipe= URL fragment containing a large number of unmatched quote characters reaches Utils.parseRecipeConfig(). The function synchronously applies a complex global regular expression that may perform heavy backtracking before rejecting the input, causing the victim's browser tab to freeze during startup for seconds or longer. No code execution, data exfiltration, or privilege escalation occurs. This issue is fixed in version 11.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-72912

Affected Vendors & Products

Vendor	Product	Version / Range
gchq	cyberchef	to 11.3.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

CyberChef is a web tool for encryption and data processing. A flaw in its recipe parser before version 11.3.0 allows a malformed URL fragment with many unmatched quotes to freeze a user's browser tab. The parser uses a complex regular expression that causes excessive CPU usage due to backtracking, making the browser unresponsive.

Detection Guidance

This vulnerability is specific to the CyberChef web application and involves a malformed URL fragment triggering excessive CPU usage. Detection requires checking the CyberChef version in use. If you are running CyberChef version 11.3.0 or later, the vulnerability is not present. For earlier versions, inspect network traffic for URLs containing #recipe= with unusually large numbers of unmatched quotes.

Impact Analysis

This vulnerability can cause your browser tab to freeze or become unresponsive when opening a malicious link. It does not steal data or gain unauthorized access but disrupts normal use of CyberChef until the tab is closed or the browser is restarted.

Mitigation Strategies

Upgrade CyberChef to version 11.3.0 or later immediately. If upgrading is not possible, restrict access to the CyberChef application or block URLs containing #recipe= fragments with suspicious patterns until the upgrade is completed.

Hi! I’m here to help you understand CVE-2026-72912. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70