EspoCRM versions prior to 9.3.11 and 10.0.8 have a denial of service flaw caused by a password‑redaction regular expression that is applied during API error handling. This regular expression consumes excessive CPU time when processing very large request bodies, which can lead to a slowdown or complete unavailability of the application for legitimate users. The vulnerability permits unauthenticated remote actors to trigger the denial of service by sending a small number of large API requests, exhausting server workers and causing service disruption. The weakness is classified as CWE‑1333, reflecting the use of an inefficient regular expression in a system that processes untrusted data.

EspoCRM products identified as espocrm:espocrm are affected. In particular, all installations using EspoCRM 9.x up to 9.3.10 and 10.x up to 10.0.7 are vulnerable. User repositories and references provided in security advisories link to this vulnerability, confirming the affected range.

The CVSS score of 8.7 indicates high severity, and the lack of an EPSS score or KEV listing suggests the exploitation probability is not currently quantified but is plausible due to the unauthenticated nature of the attack and the ease of sending the large payloads. Attackers can launch this denial of service from the public internet, exploiting the system without authentication, and the impact is service availability. No privileged access is required, making the risk significant for any exposed EspoCRM instance.