Security Resilience

CVE-2026-62237

Public PoC
Published
17 July 2026
Modified
08 October 2026
CVSS Score v4 6.0
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0030 21th percentile
Risk Priority 34 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-62237 is a medium-severity Inefficient Regular Expression Complexity (CWE-1333) vulnerability. Its CVSS base score is 6.0 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled (security.twig_content.process_enabled: true, disabled by default), an…

more

authenticated page editor can supply a catastrophically backtracking PCRE pattern that is passed directly to PHP's preg_replace(), causing unbounded CPU consumption and denial of service to the web server process.

CWE(s)
CWE-1333

Related Threats

MITRE ATT&CK Enterprise Techniques

T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
attack.mitre.org →
T1499.003 Application Exhaustion Flood Impact
Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-25547Shared CWE-1333
CVE-2024-28864Shared CWE-1333
CVE-2026-45305Shared CWE-1333
CVE-2024-36751Shared CWE-1333
CVE-2026-0967Shared CWE-1333
CVE-2026-101903Shared CWE-1333
CVE-2026-71190Shared CWE-1333
CVE-2026-110856Shared CWE-1333
CVE-2024-12391Shared CWE-1333
CVE-2024-23732Shared CWE-1333

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation good match

Developer testing and evaluation can discover inefficient regex patterns via performance or static analysis.

SA-15 Development Process, Standards, and Tools partial match

Development standards and tools can require safe regex construction and forbid known exponential patterns.

SC-5 Denial-of-service Protection partial match

Denial-of-service protections limit resource exhaustion caused by expensive regex evaluation.

SI-10 Information Input Validation partial match

Input validation can constrain data that would otherwise trigger worst-case regex complexity.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
blocks

Secure SDLC practices directly prevent inefficient regex via reviews, static analysis, and safe libraries.

ID.RA-01 partial match
blocks

Vulnerability identification processes can discover ReDoS issues in existing code but do not stop their introduction.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect and reject regex patterns with exponential worst-case complexity.

A.8.28 Secure coding partial match
prevents

Secure coding standards explicitly prohibit or limit the use of inefficient regular expressions.

References