CVE-2026-41040: GROWI ReDoS Denial of Service Vulnerability

CVE-2026-41040 Overview

GROWI, a collaborative wiki application provided by GROWI, Inc., contains a Regular Expression Denial of Service (ReDoS) vulnerability. The application is susceptible to denial of service conditions when processing specially crafted input strings that exploit inefficient regular expression patterns. This vulnerability allows unauthenticated remote attackers to cause excessive CPU consumption, potentially rendering the application unresponsive.

Critical Impact

Unauthenticated attackers can exploit this ReDoS vulnerability via network-accessible endpoints to cause service degradation or complete denial of service by submitting malicious input strings that trigger catastrophic backtracking in regular expression processing.

Affected Products

• GROWI wiki application (specific vulnerable versions detailed in vendor advisory)

Discovery Timeline

• April 23, 2026 - CVE CVE-2026-41040 published to NVD
• April 23, 2026 - Last updated in NVD database

Technical Details for CVE-2026-41040

Vulnerability Analysis

This vulnerability falls under CWE-1333 (Inefficient Regular Expression Complexity), which describes conditions where regular expressions are implemented in a manner that can lead to excessive computational resource consumption. The ReDoS vulnerability in GROWI occurs when user-supplied input is processed by a vulnerable regular expression pattern that exhibits exponential time complexity under certain conditions.

The attack is network-exploitable without requiring authentication or user interaction. While the vulnerability does not directly compromise data confidentiality or integrity, it can completely disrupt service availability, making the GROWI wiki platform inaccessible to legitimate users.

Root Cause

The root cause of this vulnerability is the implementation of a regular expression pattern with suboptimal complexity characteristics. When the regex engine processes a carefully crafted input string, it enters a state of catastrophic backtracking, where the engine recursively attempts an exponentially growing number of pattern matching combinations. This pattern typically involves nested quantifiers or overlapping alternations that create ambiguous matching paths.

Attack Vector

The attack vector for CVE-2026-41040 is network-based. An unauthenticated remote attacker can submit a maliciously crafted input string to any endpoint that processes user input through the vulnerable regular expression. The attack requires no special privileges or user interaction, and the low complexity of exploitation makes this vulnerability particularly concerning for public-facing GROWI installations.

The exploitation mechanism involves constructing input strings specifically designed to maximize backtracking behavior. These strings typically consist of repetitive patterns that partially match the regular expression, forcing the regex engine to explore numerous unsuccessful paths before ultimately failing to match.

Detection Methods for CVE-2026-41040

Indicators of Compromise

• Abnormal CPU spikes on the GROWI application server during request processing
• Extended response times for HTTP requests, particularly those involving text input
• Application logs showing timeout errors or thread exhaustion warnings
• Repeated requests from the same source containing long, repetitive input patterns

Detection Strategies

• Monitor application server CPU utilization and set alerts for sustained high-CPU conditions
• Implement request timeout monitoring to detect abnormally slow request processing
• Analyze web server logs for unusually large request payloads or repetitive character patterns
• Deploy web application firewall (WAF) rules to detect ReDoS attack patterns

Monitoring Recommendations

• Enable detailed application performance monitoring on GROWI instances
• Configure alerting for request processing times exceeding normal thresholds
• Review server resource utilization trends for anomalous patterns
• Monitor thread pool exhaustion metrics in the application server

How to Mitigate CVE-2026-41040

Immediate Actions Required

• Apply the vendor security patch as documented in the GROWI News Update
• Implement request timeout limits to prevent long-running regex operations from consuming resources
• Consider deploying rate limiting on input-heavy endpoints as a temporary measure
• Review the JVN Security Advisory JVN46728373 for additional mitigation guidance

Patch Information

GROWI, Inc. has released a security update addressing this vulnerability. Administrators should consult the official GROWI News Update for specific patch details and affected version information. The JVN Security Advisory JVN46728373 provides additional technical details and remediation guidance from the Japan Vulnerability Notes coordinating body.

Workarounds

• Implement input length validation to reject excessively long strings before regex processing
• Deploy a reverse proxy or WAF with request timeout enforcement
• Consider restricting access to the affected functionality for untrusted users until patching is complete
• Configure server-side request timeout limits to automatically terminate long-running operations

# Example: Configure nginx proxy timeout to limit request processing time
proxy_read_timeout 30s;
proxy_connect_timeout 10s;
client_max_body_size 1m;