Flag Forge versions 2.3.2 and below construct a regular expression directly from the username supplied to the user profile API endpoint. This dynamic, unescaped pattern allows an attacker to send a crafted username containing a large number of nested or quantified groups, causing the MongoDB regular‑expression engine to consume excessive CPU time. The resulting denial of service can degrade performance or bring the service to a halt for other users. The weakness is identified as CWE‑1333, a regular expression denial of service.

The affected product is FlagForge CTF: FlagForge. Any deployment running version 2.3.2 or earlier is vulnerable. The issue is fixed in version 2.3.3; older versions lack the remediation and are at risk.

The CVSS score of 7.5 indicates a high severity impact on availability. The EPSS score is <1%, suggesting that at the time of analysis the likelihood of exploitation is very low but non‑zero. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit it by sending a specially crafted HTTP request targeting the /api/user/[username] endpoint, where the [username] component contains regex meta‑characters. This request forces the server to perform an expensive pattern match, consuming CPU resources and potentially disrupting service for legitimate users.