CVE-2026-62237

The record

Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled (security.twig_content.process_enabled: true, disabled by default), an authenticated page editor can supply a catastrophically backtracking PCRE pattern that is passed directly to PHP's preg_replace(), causing unbounded CPU consumption and denial of service to the web server process.

Affected packages

Related vulnerabilities

• CVE-2026-121577 Inefficient Regular Expression Complexity (CWE-1333) in generate_regex()… CWE-1333
• CVE-2026-120217 A vulnerability was detected in Delgan loguru 0.7.3. CWE-1333
• CVE-2026-62864 Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. CWE-1333
• CVE-2026-119300 Wekan is open source kanban built with Meteor. CWE-1333
• CVE-2026-118993 CallBackery versions before 0.62.0 for Perl allow denial of service via the request path… CWE-1333
• CVE-2026-115866 Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular… CWE-1333
• CVE-2026-119202 @hapi/content provides HTTP Content-* header parsing. CWE-1333
• CVE-2026-118779 Forge (also called node-forge) is a native implementation of Transport Layer Security in… CWE-1333