CVE-2026-44796 describes a Denial of Service (DoS) vulnerability discovered in Nautobot. Attackers can trigger this vulnerability by crafting malicious regular expressions within the find field of UI object-bulk-rename endpoints, combined with the use_regex flag. This can lead to an application-wide denial of service, rendering the Nautobot interface unresponsive. The vulnerability affects versions of Nautobot up to 3.1.1, and a fix is available in version 3.1.2.
このCVEがあなたのプロジェクトに影響するか確認
requirements.txt ファイルをアップロードすると、影響の有無を即座にお知らせします。
影響と攻撃シナリオ翻訳中…
The primary impact of CVE-2026-44796 is a denial of service. A successful exploit can overwhelm the Nautobot application with regular expression evaluation, preventing legitimate users from accessing and managing network devices and configurations. This disruption can significantly impact network operations and troubleshooting efforts. The vulnerability lies within the UI object-bulk-rename endpoints, specifically when the use_regex flag is enabled alongside a malicious find parameter. The regular expression engine's inability to handle complex or poorly formed patterns can lead to excessive resource consumption and application instability. The blast radius is the entire Nautobot application, potentially impacting all users.
悪用の状況翻訳中…
CVE-2026-44796 was published on May 13, 2026. The vulnerability's severity is rated as Medium. No public proof-of-concept (POC) code has been publicly disclosed at the time of writing. There are no indications of active exploitation campaigns targeting this vulnerability. The NVD and CISA databases reflect the publication date.
脅威インテリジェンス
エクスプロイト状況
CVSS ベクトル
これらのメトリクスの意味は？
- Attack Vector
- ネットワーク — インターネット経由でリモートから悪用可能。物理・ローカルアクセス不要。
- Attack Complexity
- 低 — 特別な条件不要。安定して悪用可能。
- Privileges Required
- 低 — 有効なユーザーアカウントがあれば十分。
- User Interaction
- なし — 自動かつ無音の攻撃。被害者は何もしない。
- Scope
- 変化なし — 影響は脆弱なコンポーネントのみ。
- Confidentiality
- なし — 機密性への影響なし。
- Integrity
- なし — 完全性への影響なし。
- Availability
- 高 — 完全なクラッシュまたはリソース枯渇。完全なサービス拒否。
影響を受けるソフトウェア
タイムライン
- 公開日
緩和策と回避策翻訳中…
The recommended mitigation for CVE-2026-44796 is to upgrade to Nautobot version 3.1.2 or later. This version introduces a general-purpose timeout to the affected endpoints, preventing regular expression evaluation from continuing indefinitely. If upgrading is not immediately feasible, consider restricting access to the /dcim/interfaces/rename/ and similar endpoints to trusted users only. While a direct workaround isn't available, careful input validation on the find field could offer limited protection, but is not a substitute for patching. After upgrading, confirm the fix by attempting to trigger the vulnerability with a known malicious regular expression and verifying that the request times out as expected.
修正方法翻訳中…
公式パッチはありません。回避策を確認するか、アップデートを監視してください。
よくある質問翻訳中…
What is CVE-2026-44796 — DoS in Nautobot?
CVE-2026-44796 is a Denial of Service vulnerability in Nautobot affecting versions up to 3.1.1. It allows attackers to cause a denial of service by exploiting regular expression handling in UI bulk-rename endpoints.
Am I affected by CVE-2026-44796 in Nautobot?
You are affected if you are running Nautobot version 3.1.1 or earlier. The vulnerability lies in how the application handles regular expressions in specific UI endpoints.
How do I fix CVE-2026-44796 in Nautobot?
Upgrade to Nautobot version 3.1.2 or later. This version includes a timeout mechanism to prevent indefinite regular expression evaluation and mitigate the DoS vulnerability.
Is CVE-2026-44796 being actively exploited?
There are currently no public reports or indications of active exploitation campaigns targeting CVE-2026-44796.
Where can I find the official Nautobot advisory for CVE-2026-44796?
Refer to the Nautobot security advisories page for the latest information and official announcements regarding CVE-2026-44796: [https://nautobot.io/security/](https://nautobot.io/security/)
このCVEがあなたのプロジェクトに影響するか確認
requirements.txt ファイルをアップロードすると、影響の有無を即座にお知らせします。
Pythonプロジェクトを今すぐスキャン — アカウント不要
Upload your requirements.txt and get the vulnerability report instantly. No account. Uploading the file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
依存関係ファイルをドラッグ＆ドロップ
composer.lock、package-lock.json、requirements.txt、Gemfile.lock、pubspec.lock、Dockerfile...