CVE-2026-41040 describes a ReDoS vulnerability in GROWI, a product by GROWI, Inc., affecting versions 7.5.0 and earlier. The vulnerability is due to inefficient handling of crafted input strings in regular expressions, which can be exploited to cause denial of service by exhausting processing resources. The CVSS score of 7.5 reflects a high impact on availability without affecting confidentiality or integrity. No vendor advisory or patch information is provided, and the vulnerability is not known to be exploited in the wild.

Successful exploitation of this vulnerability can result in denial of service conditions, impacting the availability of the GROWI application. There is no indication of confidentiality or integrity compromise. The attack requires no privileges or user interaction and can be performed remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting exposure of the affected GROWI versions to untrusted networks and monitor for unusual resource consumption patterns that may indicate exploitation attempts.