An issue in aaPanel version 7.57.0’s VirtualHost configuration handling/parser component allows an attacker to trigger a Regular Expression Denial of Service (ReDoS) by submitting crafted input. The flaw leads to uncontrolled resource consumption during regex processing, resulting in excessive CPU usage or memory usage that can degrade service performance or cause a complete outage. The vulnerability is identified as CWE‑400 (Uncontrolled Resource Consumption).

The affected product is aaPanel version 7.57.0, as identified by the CPE entry cpe:2.3:a:aapanel:aapanel:7.57.0.*.*.*.*.*

The CVSS score of 7.5 places this vulnerability in the high severity range, indicating a significant impact if successfully exploited. EPSS indicates a very low overall exploitation probability (< 1 %), and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector is remote, requiring an attacker to influence the virtual host configuration processing through malicious web requests handled by aaPanel, which would lead to application slowdown or denial of service for legitimate users.