CVE-2026-58270

MediumCVSS 6.5/10Last modified Sep 24, 2026

Description

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a `RegExp` with no complexity validation. A catastrophic-backtracking pattern (e.g. `^(a+)+b`) blocks the Node.js event loop, making the entire server unresponsive to all users until the container is restarted. Version 2.4.0 patches the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1333

Affected software

No affected versions have been published.

Timeline

Published: Sep 21, 2026
Last modified: Sep 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-582716.8Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync CVE-2026-582725.3Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observab CVE-2026-582759.8Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.CVE-2026-582767.5Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-582778.8Improper authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-582785.4Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.CVE-2026-582796.5Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.CVE-2026-58287.3A vulnerability was found in code-projects Simple IT Discussion Forum 1.0. The affected element is an unknown function of the file /function CVE-2026-582807.5Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-582818.3Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-582826.9Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.CVE-2026-582836.9Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform