{"id":"CVE-2026-58270","published":"2026-09-21T21:17:06.060","lastModified":"2026-09-21T21:17:06.060","description":"Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a `RegExp` with no complexity validation. A catastrophic-backtracking pattern (e.g. `^(a+)+b`) blocks the Node.js event loop, making the entire server unresponsive to all users until the container is restarted. Version 2.4.0 patches the issue.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-1333"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Sync-in/server/security/advisories/GHSA-jx63-h26r-8cph","tags":[]}],"exploitRefs":[{"url":"https://github.com/Sync-in/server/security/advisories/GHSA-jx63-h26r-8cph","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows a catastrophic-backtracking regular expression pattern to block the server, rendering it unresponsive. This matters because an attacker can exploit this to deny service to all users.","exploitability":"Exploitation requires knowledge of crafting a specific regex pattern and access to the sync diff endpoint; preconditions include running Sync-in Server version <2.4.0.","blast_radius":"If exploited, the entire server becomes unresponsive, impacting all users until a restart is performed.","remediation":"Upgrade to Sync-in Server version 2.4.0 or later immediately.","tags":["regex","denial-of-service","server"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-22T06:20:31.489Z"}}