The vulnerability exists in the validateRegex function of the Session Grep Endpoint in Enderfga claw-orchestrator. By supplying crafted input to the body.pattern argument, an attacker can cause the server to perform an inefficient regular expression evaluation, leading to excessive CPU usage and potential denial of service. The weakness is classified as CWE‑1333 and CWE‑400, indicating a denial of service flaw and a resource exhaustion vulnerability. The impact is that a malicious request can slow or crash the service, compromising availability for legitimate users.

Enderfga claw-orchestrator software versions up to and including 3.7.0 are affected. The problematic code resides in claw-orchestrator/src/embedded-server.ts within the Session Grep Endpoint component. Version 3.7.1 contains the patch identified by commit 3f970a974c65a94555c25af9f2796f11315e4584, which resolves the issue.

The CVSS score of 5.3 reflects a moderate severity. No EPSS data is available, making it uncertain how frequently exploitation is attempted. The vulnerability is not listed in CISA KEV, suggesting it has not been widely exploited in the wild. A remote attacker can trigger the exploit by sending a specially crafted request to the validateRegex endpoint, and the attack requires no privileged access or authentication, indicating a high likelihood of exploitation in exposed environments.