CVE-2026-21868 Flag Forge has ReDoS Vulnerability in User Profile Lookup API

High 7.5 Published 8 Jan 2026 Updated 8 Jan 2026

An attacker can cause a denial of service in Flag Forge by sending crafted usernames that trigger excessive CPU usage in the regex engine.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-21868?

CVE-2026-21868 is a high-severity denial of service vulnerability in FlagForgeCTF flagForge, published on 8 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Flag Forge is a Capture The Flag (CTF) platform. Versions 2.3.2 and below have a Regular Expression Denial of Service (ReDoS) vulnerability in the user profile API endpoint (/api/user/[username]). The application constructs a regular expression dynamically using unescaped user input (the username parameter). An attacker can exploit this by sending a specially crafted username containing regex meta-characters (e.g., deeply nested groups or quantifiers), causing the MongoDB regex engine to consume excessive CPU resources. This can lead to Denial of Service for other users. The issue is fixed in version 2.3.3. To workaround this issue, implement a Web Application Firewall (WAF) rule to block requests containing regex meta-characters in the URL path.

Weakness: CWE-1333

Which versions are affected by CVE-2026-21868?

It affects 1 product.

Products include Flagforge Flagforge.

How do I fix CVE-2026-21868?

No fix has been published for CVE-2026-21868 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-21868 being exploited?

There is no known exploitation of CVE-2026-21868 in the wild and no public exploit code.

Sources

Also known as GHSA-949h-9824-xmcx.