CVE-2026-59966: Tandoor Recipes ReDoS DOS Vulnerability

CVE-2026-59966 Overview

Tandoor Recipes is an open-source application for managing recipes, planning meals, and building shopping lists. Versions prior to 2.6.10 evaluate user-controlled Automation regular-expression patterns using Python re.sub() without complexity validation or an execution timeout. An authenticated user in a shared Space can store a catastrophic-backtracking regex, and any user who imports a matching recipe triggers evaluation of the malicious pattern. The regex can occupy a Gunicorn worker until its request timeout fires, exhausting worker slots and making the service unavailable. The weakness is classified as inefficient regular expression complexity [CWE-1333].

Critical Impact
An authenticated low-privileged user can store a malicious regex in a shared Space and cause denial of service against all users who import recipes through the api/recipe-from-source/ endpoint.

Affected Products

Tandoor Recipes versions prior to 2.6.10
Deployments running the shared-Space automation engine
Instances using Gunicorn workers for request processing

Discovery Timeline

2026-10-16 - CVE-2026-59966 published to the National Vulnerability Database (NVD)
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-59966

Vulnerability Analysis

The vulnerability resides in Tandoor Recipes' Automation engine, specifically in the apply_regex_replace_automation code path. When a user triggers a recipe import, the engine iterates over stored Automation records and invokes Python's standard re.sub() against the imported content using Automation.param_2 as the pattern. Because re.sub() runs synchronously inside a Gunicorn worker and offers no timeout, a crafted catastrophic-backtracking expression blocks the worker thread until the HTTP request timeout fires. Repeated imports can saturate every available worker, producing a denial-of-service condition for the entire tenant.

Root Cause

The root cause is the use of Python's built-in re module without input validation or an execution deadline. User-supplied patterns are stored as-is and later executed against attacker-influenceable recipe payloads. There is no complexity check (for example, limiting nested quantifiers) and no watchdog to abort runaway matches.

Attack Vector

Exploitation requires an authenticated account with permission to create Automation entries in a shared Space. The attacker stores a ReDoS pattern in Automation.param_2, then waits for any Space member to call api/recipe-from-source/ with content that triggers backtracking. User interaction (importing a recipe) is required, which aligns with the attack vector profile for this issue.

python

# Security patch in cookbook/helper/automation_helper.py
-import re
+import regex
 
 from django.core.cache import caches
 from django.db.models.functions import Lower
 
 from cookbook.models import Automation
 
+REGEX_TIMEOUT = 0.05
 
 class AutomationEngine:
     request = None

Source: GitHub Commit adc2732

Detection Methods for CVE-2026-59966

Indicators of Compromise

Gunicorn worker processes stuck at 100% CPU for durations approaching the configured request timeout.
HTTP 502 or 504 responses from the Tandoor Recipes frontend immediately following requests to api/recipe-from-source/.
Automation records containing patterns with nested quantifiers such as (a+)+$ or long alternations in the param_2 field.

Detection Strategies

Audit the Automation table for recently created or modified entries whose param_2 field contains suspicious regex constructs.
Correlate recipe import API calls with worker CPU spikes and request timeouts to surface exploitation attempts.
Review access logs for repeated calls to api/recipe-from-source/ originating from the same account within a short window.

Monitoring Recommendations

Enable Gunicorn worker-level logging and alert on WORKER TIMEOUT events exceeding baseline rates.
Instrument the automation engine with per-request duration metrics scoped by Space and user.
Monitor Django request latency percentiles for the recipe import endpoint and alert on sustained regressions.

How to Mitigate CVE-2026-59966

Immediate Actions Required

Upgrade Tandoor Recipes to version 2.6.10 or later, which replaces re with the regex module and enforces a REGEX_TIMEOUT of 0.05 seconds.
Review all existing Automation entries in each Space and remove patterns authored by untrusted members.
Restrict Automation creation privileges to administrators in multi-tenant Spaces until patching completes.

Patch Information

The fix is delivered in Tandoor Recipes release 2.6.10. The patch swaps Python's standard re library for the third-party regex package, which supports timeout-bounded execution, and introduces a REGEX_TIMEOUT = 0.05 constant inside cookbook/helper/automation_helper.py. See the GitHub Security Advisory GHSA-f2gw-c2c7-59v7 for the complete disclosure.

Workarounds

Temporarily disable the recipe import workflow or block the api/recipe-from-source/ endpoint at the reverse proxy.
Reduce the Gunicorn request timeout to limit worker occupation and configure additional workers to absorb slow requests.
Remove or audit all user-authored Automation records with regex-based actions until the upgrade is applied.

bash

# Upgrade Tandoor Recipes to the patched release
pip install --upgrade regex==2026.5.9
# Pull patched container image
docker pull vabene1111/recipes:2.6.10
docker compose up -d