CVE-2026-59966

Received Received - Intake

ReDoS in Tandoor Recipes via Automation Regex

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout when an authenticated user stores a catastrophic-backtracking regex and any user in the same Space imports a matching recipe. Request processing uses Automation.param_2, apply_regex_replace_automation, sub, api/recipe-from-source/. The attack works because the shared-Space automation engine evaluates the malicious pattern during recipe import and can occupy a Gunicorn worker until its request timeout. This can exhaust application worker slots and make the service unavailable to users. This issue is fixed in version 2.6.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-59966

EUVD

EUVD-2026-103143

Affected Vendors & Products

Vendor	Product	Version / Range
TandoorRecipes	recipes	< 2.6.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Attack-Flow Graph

Executive Summary

Tandoor Recipes before 2.6.10 allows authenticated users to store malicious regular-expression patterns that cause catastrophic backtracking. When another user in the same Space imports a recipe, the shared automation engine evaluates the regex during processing. This consumes excessive CPU resources in a Gunicorn worker until the request times out, potentially exhausting worker slots and making the service unavailable.

Detection Guidance

Detecting this vulnerability requires checking if your Tandoor Recipes instance is running a version prior to 2.6.10. Use commands like 'pip show tandoor-recipes' or check the version in the application settings. Inspect logs for slow or hanging requests during recipe imports, which may indicate catastrophic backtracking.

Impact Analysis

If exploited, this vulnerability can lead to denial-of-service by crashing or slowing down the Tandoor Recipes application. Users may experience delays or complete unavailability when trying to access recipes, meal plans, or shopping lists. The attack requires an authenticated user to store the malicious regex and another user to trigger it via recipe import.

Compliance Impact

This vulnerability primarily impacts availability by exhausting application worker slots, which could lead to service unavailability. While not directly violating GDPR or HIPAA, prolonged unavailability may affect compliance with data access or processing timelines required by these regulations.

Mitigation Strategies

Upgrade Tandoor Recipes to version 2.6.10 or later immediately. If upgrading is not possible, restrict user access to recipe imports and automation features until patched. Monitor Gunicorn worker processes for unusual CPU usage or unresponsiveness.

Hi! I’m here to help you understand CVE-2026-59966. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70