Description
Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a `RegExp` with no complexity validation. A catastrophic-backtracking pattern (e.g. `^(a+)+b`) blocks the Node.js event loop, making the entire server unresponsive to all users until the container is restarted. Version 2.4.0 patches the issue.
Published: 2026-09-21
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

Sync‑in Server exposes a ReDoS vulnerability in the sync diff endpoint. An attacker can send a specially crafted path filter string, such as ^(a+)+b, which causes catastrophic backtracking when compiled into a RegExp. This stalls the Node.js event loop, rendering the entire server unresponsive to all users until a restart. The flaw stems from unsanitized user input being directly inserted into a regular expression with no complexity validation.

Affected Systems

Sync‑in Server versions earlier than 2.4.0, running on any supported Node.js environment, are affected. The issue was patched in version 2.4.0.

Risk and Exploitability

The CVSS score is 6.5, indicating moderate severity. EPSS is not available and the CVE is not listed in the CISA KEV catalog. The likely attack vector is remote exploitation via the sync diff HTTP API, where a malicious user can abuse the pathFilters parameter. The vulnerability does not allow code execution or privilege escalation but causes full service disruption, which is costly in a shared server environment.

Generated by OpenCVE AI on September 21, 2026 at 21:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Sync‑in Server to version 2.4.0 or later.
  • Restrict or validate the pathFilters parameter to prevent overly complex regular expressions, for example by limiting length or rejecting patterns containing nested quantifiers.
  • Apply rate limiting or request throttling on the sync diff endpoint to mitigate the impact of accidental or malicious requests.

Generated by OpenCVE AI on September 21, 2026 at 21:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-jx63-h26r-8cph Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`
History

Thu, 24 Sep 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 21 Sep 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Sync-in
Sync-in server
Vendors & Products Sync-in
Sync-in server

Mon, 21 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
Description Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a `RegExp` with no complexity validation. A catastrophic-backtracking pattern (e.g. `^(a+)+b`) blocks the Node.js event loop, making the entire server unresponsive to all users until the container is restarted. Version 2.4.0 patches the issue.
Title Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`
Weaknesses CWE-1333
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Sync-in Server
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-22T14:06:46.587Z

Reserved: 2026-06-29T21:54:30.332Z

Link: CVE-2026-58270

cve-icon Vulnrichment

Updated: 2026-09-22T14:06:42.743Z

cve-icon NVD

Status : Deferred

Published: 2026-09-21T21:17:06.060

Modified: 2026-09-24T21:25:27.050

Link: CVE-2026-58270

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T21:30:11Z

Weaknesses
  • CWE-1333

    Inefficient Regular Expression Complexity