CVE-2026-58270

6.5 MEDIUMpublic exploit available

Published 2026-09-21 · Updated 2026-09-21

AI risk analysis

Summary: The flaw allows a catastrophic-backtracking regular expression pattern to block the server, rendering it unresponsive. This matters because an attacker can exploit this to deny service to all users.
Exploitability: Exploitation requires knowledge of crafting a specific regex pattern and access to the sync diff endpoint; preconditions include running Sync-in Server version <2.4.0.
Blast radius: If exploited, the entire server becomes unresponsive, impacting all users until a restart is performed.
Prioritized remediation: Upgrade to Sync-in Server version 2.4.0 or later immediately.

regexdenial-of-serviceserver

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a `RegExp` with no complexity validation. A catastrophic-backtracking pattern (e.g. `^(a+)+b`) blocks the Node.js event loop, making the entire server unresponsive to all users until the container is restarted. Version 2.4.0 patches the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-1333

Public exploit & PoC references

https://github.com/Sync-in/server/security/advisories/GHSA-jx63-h26r-8cph

All references

https://github.com/Sync-in/server/security/advisories/GHSA-jx63-h26r-8cph

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.