CVE-2026-59966: CWE-1333: Inefficient Regular Expression Complexity in TandoorRecipes recipes

Tandoor Recipes before version 2.6.10 executes user-supplied Automation regular-expression patterns with Python's re.sub() function without validating regex complexity or enforcing execution timeouts. An authenticated user can store a regex pattern that triggers catastrophic backtracking. When any user in the same shared Space imports a matching recipe, the automation engine evaluates this pattern, potentially occupying a Gunicorn worker until the request times out. This can exhaust available worker slots, leading to denial of service for other users. The vulnerability affects the Automation.param_2, apply_regex_replace_automation, sub, and api/recipe-from-source/ components. The issue is resolved in version 2.6.10.

The vulnerability allows denial of service by exhausting application worker slots due to long-running regex evaluation. It does not impact confidentiality or integrity but can cause service unavailability for users sharing the same Space. No known exploits in the wild have been reported.

Upgrade Tandoor Recipes to version 2.6.10 or later, where this issue is fixed. No other mitigation is required as the vendor has provided an official fix.