CVE-2026-44796: Nautobot Denial of Service via ReDoS in Bulk-Rename Endpoints

Technical summary

The vulnerability exists in Nautobot's UI object-bulk-rename endpoints (such as /dcim/interfaces/rename/) where insufficient validation of regular expressions combined with the use_regex flag allows ReDoS (Regular Expression Denial of Service) attacks. When a maliciously crafted regex pattern with excessive backtracking is processed, the application consumes CPU resources uncontrollably, triggering an application-wide denial of service. This is categorized under CWE-1333 (Inefficient Regular Expression Complexity) and CWE-400 (Uncontrolled Resource Consumption).

Business impact

For organizations using Nautobot as their network source of truth, this vulnerability creates operational risk. An authenticated user—whether a legitimate account or a compromised credential—can render the platform unavailable, blocking network automation workflows, device inventory queries, and configuration management tasks during the attack. Recovery requires service restart, creating unplanned downtime.

Affected systems

Nautobot versions prior to 2.4.33 (2.4.x branch) and 3.1.2 (3.1.x branch) are affected. The vulnerability is specific to the bulk-rename UI endpoints and requires the attacker to have valid authentication credentials to the Nautobot instance.

Exploitability

Exploitability is moderate. The attack requires authentication (authenticated users or those with valid credentials), ruling out completely unauthenticated internet-facing attacks. However, the barrier to exploitation is low once authenticated: an attacker need only craft a ReDoS pattern and submit it via the bulk-rename form. No complex multi-step exploit chain is required. Internal threats, disgruntled employees, or compromised accounts pose the primary risk.

Remediation

Upgrade Nautobot to version 2.4.33 or later (for the 2.4.x series) or 3.1.2 or later (for the 3.1.x series). Verify the patched version is confirmed in your deployment before restart. Organizations unable to upgrade immediately should restrict access to bulk-rename endpoints via application firewall rules or network controls, limiting exposure to trusted administrative accounts only.

Patch guidance

NetworkToCode has released patches in Nautobot 2.4.33 and 3.1.2. Consult the official NetworkToCode security advisories and release notes to verify patch availability for your branch and confirm no additional breaking changes. Test the upgrade in a non-production environment first. After upgrading, restart the Nautobot service to ensure the fix is active.

Detection guidance

Monitor Nautobot logs for repeated requests to bulk-rename endpoints (/dcim/interfaces/rename/, similar paths) originating from a single authenticated user or session within a short timeframe, particularly those with complex or unusual regex patterns in the 'find' parameter. Application performance monitoring can detect sudden CPU spikes correlated with bulk-rename requests. Network segmentation and authentication logs can identify lateral movement from compromised accounts exploiting this flaw.

Why prioritize this

This vulnerability scores CVSS 6.5 (MEDIUM) and is best prioritized based on your exposure model: if Nautobot is internet-facing or accessible to high-risk user populations (e.g., contractors, external partners), prioritize patching within 2–4 weeks. If Nautobot is internal-only with access restricted to vetted staff, extend the window to 4–8 weeks. The lack of CISA KEV status indicates this is not yet actively exploited in the wild, reducing urgency but not eliminating risk.

Risk score, explained

The CVSS 6.5 score reflects a network-accessible service (AV:N), low complexity attack (AC:L), authenticated requirement (PR:L), and high availability impact (A:H). The score does not account for business criticality; organizations relying on Nautobot for real-time network operations may perceive risk as higher. The absence of confidentiality or integrity impact limits the base score but does not diminish the operational harm of service unavailability.

Frequently asked questions