The vulnerability exists in the validate_email function located in CTFd/utils/validators/__init__.py in CTFd version 3.7.3. An attacker can supply a specially crafted email address string during registration that triggers a Regular expression Denial of Service (ReDoS) condition. This occurs because the regular expression used for email validation can be exploited to consume excessive CPU resources, leading to denial of service. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low complexity, no privileges or user interaction required, and an impact limited to availability (denial of service). No known exploits are reported in the wild, and no patch or remediation information is currently provided.

The impact is a denial of service condition caused by the vulnerable regular expression in the email validation function. This can disrupt the availability of the CTFd service by exhausting CPU resources when processing maliciously crafted email inputs during registration. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing input validation or rate limiting on registration attempts to mitigate potential abuse. Monitor for updates from the CTFd project regarding a patch or official mitigation.