CVE-2026-21868

Flag Forge is a Capture The Flag (CTF) platform. Versions 2.3.2 and below have a Regular Expression Denial of Service (ReDoS) vulnerability in the user profile API endpoint (/api/user/[username]). The application constructs a regular expression dynamically using unescaped user input (the username parameter). An attacker can exploit this by sending a specially crafted username containing regex meta-characters (e.g., deeply nested groups or quantifiers), causing the MongoDB regex engine to consume excessive CPU resources. This can lead to Denial of Service for other users. The issue is fixed in version 2.3.3. To workaround this issue, implement a Web Application Firewall (WAF) rule to block requests containing regex meta-characters in the URL path.

• CWE-1333

• https://github.com/FlagForgeCTF/flagForge/security/advisories/GHSA-949h-9824-xmcxVendor Advisory

Published

Jan 8, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-21862RustFS is a distributed object storage system built in Rust.…7.5
• CVE-2026-21863Valkey is a distributed key-value database. Prior to version…7.5
• CVE-2026-21864Valkey-Bloom is a Rust based Valkey module which brings a Bl…7.5
• CVE-2026-21865Discourse is an open source discussion platform. In versions…6.5
• CVE-2026-21866Dify is an open-source LLM app development platform. Prior t…5.4
• CVE-2026-21867Rejected reason: Reason: This candidate was issued in error.
• CVE-2026-21869llama.cpp is an inference of several LLM models in C/C++. In…9.8
• CVE-2026-2187A vulnerability was found in Tenda RX3 16.03.13.11. The affe…8.8
• CVE-2026-21870BACnet Protocol Stack library provides a BACnet application …5.5
• CVE-2026-21871NiceGUI is a Python-based UI framework. From versions 2.13.0…6.1
• CVE-2026-21872NiceGUI is a Python-based UI framework. From versions 2.22.0…6.1
• CVE-2026-21873NiceGUI is a Python-based UI framework. From versions 2.22.0…6.1