Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Grav pages can be used to freeze the site

CVE-2026-62237 · published 3 months ago
Summary

In versions of Grav before 2.0.4, a page editor could add a specially crafted pattern that makes the server work endlessly, blocking visitors from accessing the site. This happens when a certain processing option is turned on. Updating Grav to version 2.0.4 removes the unsafe behavior and restores normal operation.

What to do
  • Update getgrav grav to version 2.0.4.
Affected software
Ecosystem VendorProductAffected versions
– getgrav grav < 2.0.4
composer getgrav grav < 2.0.4
Fix: upgrade to 2.0.4
Original advisory text
Grav < 2.0.4 ReDoS via regex_replace in Sandbox
Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled (security.twig_content.process_enabled: true, disabled by default), an authenticated page editor can supply a catastrophically backtracking PCRE pattern that is passed directly to PHP's preg_replace(), causing unbounded CPU consumption and denial of service to the web server process.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-1333Inefficient Regular Expression Complexity (ReDoS)
Timeline
Published17 Jul 2026
Updated4 Nov 2026
First seen19 Aug 2026
Sources
CVE-2026-62672 · NVD
CVE-2026-62672 · MITRE
CVE-2026-62237 · OSV
GHSA-37f3-6p89-6qr9 · GHSA
Track software like this
Free during beta