CVE-2026-10692: ReDoS Vulnerability in code-index-mcp Up to 2.14.0 – Patch Available

Technical summary

CVE-2026-10692 is a ReDoS (Regular Expression Denial of Service) vulnerability in the is_safe_regex_pattern function within johnhuang316's code-index-mcp library. The vulnerability stems from insufficient validation of regex pattern complexity before execution. Attackers authenticated to the system can supply catastrophically backtracking regular expressions through the search_code_advanced component, causing the application to enter exponential-time matching loops. The vulnerability maps to CWE-1333 (Inefficient Regular Expression Complexity) and CWE-400 (Uncontrolled Resource Consumption), indicating both the root cause and the attack outcome.

Business impact

For organizations deploying code-index-mcp as part of their code search or indexing infrastructure, this vulnerability presents a localized availability risk. An authenticated insider or compromised account could repeatedly trigger regex processing to disrupt search functionality, impacting development workflows and potentially delaying incident response activities that depend on code indexing. Since authentication is required, the attack surface is limited to users with system access, reducing enterprise-wide risk but warranting prompt patching to eliminate the vector entirely.

Affected systems

johnhuang316 code-index-mcp versions 2.14.0 and earlier are affected. The issue is resolved in version 2.14.1 and later. Organizations should audit deployments to identify running instances and verify version numbers. The vulnerability is present in the search_code_advanced component specifically, making this attack surface relevant primarily to workflows that use the advanced search feature.

Exploitability

Exploitation requires network access and valid authentication credentials. The attack is straightforward once credentials are obtained—no special tools or deep expertise are required; an attacker simply crafts a pathological regex pattern and submits it through the vulnerable function. Public exploit information is available, increasing the likelihood of both opportunistic and targeted attacks from insiders or adversaries with stolen credentials. However, the login requirement significantly limits exposure compared to unauthenticated vulnerabilities.

Remediation

Upgrade code-index-mcp to version 2.14.1 or later immediately. This patch addresses the regex validation weakness in is_safe_regex_pattern and prevents catastrophic backtracking. Additionally, consider implementing rate-limiting on search operations and monitoring for unusual regex submission patterns (e.g., repeated attempts with complex patterns) to detect potential exploitation attempts while patching is underway.

Patch guidance

Apply version 2.14.1 via your package manager or download the release containing commit 25bc02fac74051ddae15ce79e952f00211b1ea6b. Verify the patch by confirming the version string and commit hash post-deployment. If using code-index-mcp in a containerized environment, rebuild images with the updated version and redeploy. Test search functionality after patching to confirm no regressions. No special configuration changes are required for this patch.

Detection guidance

Monitor application logs for repeated or unusual regex patterns submitted to the search_code_advanced endpoint, particularly those containing complex quantifiers or nested groups. Watch for spikes in CPU usage correlated with search requests. Network-based detection is limited due to the requirement for authentication; focus detection efforts on insider threat monitoring and account compromise detection. Log all searches and review for patterns indicative of ReDoS attacks, such as exponential backtracking strings or known pathological regex examples.

Why prioritize this

While the CVSS score of 4.3 (Medium) reflects low impact—affecting only availability, not confidentiality or integrity—the public availability of exploitation information and the straightforward attack method argue for near-term patching. The requirement for authentication reduces urgency slightly, but code-index-mcp is often deployed in development environments with relatively relaxed access controls. Patch within 30 days or sooner if the tool is exposed to untrusted user accounts.

Risk score, explained

The CVSS 3.1 score of 4.3 is driven by: Network-accessible attack vector (AV:N); Low attack complexity (AC:L), as no special conditions are required; Requirement for low-privilege authentication (PR:L); No impact on confidentiality or integrity (C:N, I:N); Low availability impact (A:L), since the attack causes degradation rather than total outage. The score does not escalate to High because the attack requires valid credentials and does not lead to data compromise. Public exploit availability elevates practical risk but does not change the base CVSS calculation.

Frequently asked questions