6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44796

CVE-2026-44796: Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot UI object-bulk-rename endpoints (for example, /dcim/interfaces/rename/) were vulnerable to application-wide denial of service via maliciously crafted regular expressions in the find field in combination with the use_regex flag. This vulnerability is fixed in 2.4.33 and 3.1.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44796

CVE-2026-44796:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nautobot	pip	>= 3.0.0a2, < 3.1.2	3.1.2
nautobot	pip	< 2.4.33	2.4.33

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in several bulk renaming views and mixins within Nautobot that use Python's re module for regular expression-based find-and-replace operations. The core of the issue is that the re.sub function was used on user-supplied regular expressions without any timeout mechanism. This makes the application susceptible to Regular Expression Denial of Service (ReDoS) attacks. An attacker could provide a specially crafted regular expression that causes 'catastrophic backtracking', leading to excessive CPU consumption and causing the application to hang or become unresponsive.

The identified vulnerable functions are BulkRenameView.post, ModuleBayCommonViewSetMixin._bulk_rename, and ObjectBulkRenameViewMixin._bulk_rename. These functions are directly involved in processing user-submitted data for bulk renaming operations. The patches for this vulnerability consistently show a shift from using the standard re module to the regex module, which supports a timeout parameter in its substitution function. By wrapping the regex operations in a try...except TimeoutError block and setting a reasonable timeout, the patch ensures that a malicious regex will not be able to tie up server resources indefinitely, thus mitigating the denial of service risk.

Vulnerable functions

BulkRenameView.post

nautobot/core/views/generic.py

This function handles the bulk renaming of objects. When the `use_regex` flag is set, it uses `re.sub` with a user-provided regex pattern. A malicious pattern could cause catastrophic backtracking, leading to a denial of service. The patch adds a timeout to the regex operation to mitigate this.

ModuleBayCommonViewSetMixin._bulk_rename

nautobot/dcim/views.py

This method provided the logic for bulk renaming module bays and module bay templates. It was vulnerable to ReDoS for the same reasons as `BulkRenameView.post`. The method was removed and replaced by a more generic and secure mixin in the patch.

ObjectBulkRenameViewMixin._bulk_rename

nautobot/core/views/mixins.py

This mixin provides a generic implementation for bulk renaming objects and is used by various viewsets. The `_bulk_rename` method was vulnerable to ReDoS as it used `re.sub` without a timeout. The patch introduces a timeout to prevent catastrophic backtracking.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.