CVE-2026-58270

Received Received - Intake

Regex ReDoS in Sync-in Server Prior to 2.4.0

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a `RegExp` with no complexity validation. A catastrophic-backtracking pattern (e.g. `^(a+)+b`) blocks the Node.js event loop, making the entire server unresponsive to all users until the container is restarted. Version 2.4.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-58270

Affected Vendors & Products

Vendor	Product	Version / Range
sync-in	server	to 2.4.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

Executive Summary

Sync-in Server before version 2.4.0 has a flaw in its sync diff endpoint where user input is compiled into a RegExp without complexity checks. Attackers can craft patterns causing catastrophic backtracking, freezing the Node.js event loop and making the server unresponsive to all users until restarted.

Detection Guidance

The vulnerability can be detected by sending a malformed regex pattern to the sync diff endpoint and observing if the server becomes unresponsive. Example curl command: curl -X POST http://<server>/sync/diff -d 'pattern=^(a+)+b'

Monitor server logs for slow responses or timeouts during regex processing. Check for high CPU usage on the Node.js process.

Impact Analysis

This vulnerability can cause a complete denial of service for all users of the Sync-in Server instance. The server becomes unresponsive, halting file storage, sharing, and collaboration until manually restarted, disrupting normal operations.

Compliance Impact

This vulnerability could lead to denial-of-service conditions, potentially disrupting availability of systems handling sensitive data. For GDPR, this may impact the right to access or rectify data if services become unavailable. For HIPAA, it could affect the availability of protected health information systems.

Mitigation Strategies

Upgrade Sync-in Server to version 2.4.0 or later to patch the regex handling issue.

Temporarily block or rate-limit requests containing suspicious regex patterns at the network level.

Restart affected containers if unresponsiveness occurs to restore service.

Hi! I’m here to help you understand CVE-2026-58270. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70