Tandoor Recipes executes user‑controlled automation regex patterns using Python’s re.sub() without complexity validation or a timeout. A malicious pattern can cause catastrophic backtracking, which blocks the Gunicorn worker until it times out, rendering the application unavailable to all users in the affected space. The vulnerability results in a denial of service, compromising availability but not confidentiality or integrity.

The vulnerable product is TandoorRecipes recipes, with affected installs prior to version 2.6.10. Any authenticated user can store a catastrophic‑backtracking regex; users in the same space can trigger the worker exhaustion when importing a recipe that matches the pattern.

The CVSS score is 5.7, indicating a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting a moderate likelihood of exploitation. Based on the description, the attack requires an authenticated user to store the malicious regex and another user to import a matching recipe, implying that the attack vector is likely internal or requires compromise of multiple users within the same workspace. The absence of a public exploit and lack of a known broker chain limits its broad‑scale risk, but the denial of service impact can still be significant for service availability.