id: PYSEC-2026-2226
published: "2026-05-28T18:16:33.417Z"
modified: "2026-07-13T05:50:10.460726Z"
aliases:
- CVE-2026-44796
- GHSA-qrpw-gjvh-x5gm
details: Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot UI object-bulk-rename endpoints (for example, /dcim/interfaces/rename/) were vulnerable to application-wide denial of service via maliciously crafted regular expressions in the find field in combination with the use_regex flag. This vulnerability is fixed in 2.4.33 and 3.1.2.
affected:
- package:
    name: nautobot
    ecosystem: PyPI
    purl: pkg:pypi/nautobot
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.4.33
    - introduced: 3.0.0
    - fixed: 3.1.2
  versions:
  - 1.0.0
  - 1.0.0a1
  - 1.0.0a2
  - 1.0.0b1
  - 1.0.0b2
  - 1.0.0b3
  - 1.0.0b4
  - 1.0.1
  - 1.0.2
  - 1.0.3
  - 1.1.0
  - 1.1.1
  - 1.1.2
  - 1.1.3
  - 1.1.4
  - 1.1.5
  - 1.1.6
  - 1.2.0
  - 1.2.1
  - 1.2.10
  - 1.2.11
  - 1.2.2
  - 1.2.3
  - 1.2.4
  - 1.2.5
  - 1.2.6
  - 1.2.7
  - 1.2.8
  - 1.2.9
  - 1.3.0
  - 1.3.1
  - 1.3.10
  - 1.3.2
  - 1.3.3
  - 1.3.4
  - 1.3.5
  - 1.3.6
  - 1.3.7
  - 1.3.8
  - 1.3.9
  - 1.4.0
  - 1.4.1
  - 1.4.10
  - 1.4.2
  - 1.4.3
  - 1.4.4
  - 1.4.5
  - 1.4.7
  - 1.4.8
  - 1.4.9
  - 1.5.0
  - 1.5.1
  - 1.5.10
  - 1.5.11
  - 1.5.12
  - 1.5.13
  - 1.5.14
  - 1.5.15
  - 1.5.16
  - 1.5.17
  - 1.5.18
  - 1.5.19
  - 1.5.2
  - 1.5.20
  - 1.5.21
  - 1.5.22
  - 1.5.23
  - 1.5.24
  - 1.5.3
  - 1.5.4
  - 1.5.5
  - 1.5.6
  - 1.5.7
  - 1.5.8
  - 1.5.9
  - 1.6.0
  - 1.6.1
  - 1.6.10
  - 1.6.11
  - 1.6.12
  - 1.6.13
  - 1.6.14
  - 1.6.15
  - 1.6.16
  - 1.6.17
  - 1.6.18
  - 1.6.19
  - 1.6.2
  - 1.6.20
  - 1.6.21
  - 1.6.22
  - 1.6.23
  - 1.6.24
  - 1.6.25
  - 1.6.26
  - 1.6.27
  - 1.6.28
  - 1.6.29
  - 1.6.3
  - 1.6.30
  - 1.6.31
  - 1.6.32
  - 1.6.4
  - 1.6.5
  - 1.6.6
  - 1.6.7
  - 1.6.8
  - 1.6.9
  - 2.0.0
  - 2.0.1
  - 2.0.2
  - 2.0.3
  - 2.0.4
  - 2.0.5
  - 2.0.6
  - 2.1.0
  - 2.1.0b1
  - 2.1.1
  - 2.1.2
  - 2.1.3
  - 2.1.4
  - 2.1.5
  - 2.1.6
  - 2.1.7
  - 2.1.8
  - 2.1.9
  - 2.2.0
  - 2.2.0b1
  - 2.2.1
  - 2.2.2
  - 2.2.3
  - 2.2.4
  - 2.2.5
  - 2.2.6
  - 2.2.7
  - 2.2.8
  - 2.2.9
  - 2.3.0
  - 2.3.0b1
  - 2.3.1
  - 2.3.10
  - 2.3.11
  - 2.3.12
  - 2.3.13
  - 2.3.14
  - 2.3.15
  - 2.3.15b1
  - 2.3.16
  - 2.3.2
  - 2.3.3
  - 2.3.4
  - 2.3.5
  - 2.3.6
  - 2.3.7
  - 2.3.8
  - 2.3.9
  - 2.4.0
  - 2.4.0b1
  - 2.4.1
  - 2.4.10
  - 2.4.11
  - 2.4.12
  - 2.4.13
  - 2.4.14
  - 2.4.15
  - 2.4.16
  - 2.4.17
  - 2.4.18
  - 2.4.19
  - 2.4.2
  - 2.4.20
  - 2.4.21
  - 2.4.22
  - 2.4.23
  - 2.4.24
  - 2.4.25
  - 2.4.26
  - 2.4.27
  - 2.4.28
  - 2.4.29
  - 2.4.3
  - 2.4.30
  - 2.4.31
  - 2.4.32
  - 2.4.4
  - 2.4.5
  - 2.4.6
  - 2.4.7
  - 2.4.8
  - 2.4.9
  - 3.0.0
  - 3.0.1
  - 3.0.10
  - 3.0.11
  - 3.0.2
  - 3.0.3
  - 3.0.4
  - 3.0.5
  - 3.0.6
  - 3.0.7
  - 3.0.8
  - 3.0.9
  - 3.1.0
  - 3.1.0a1
  - 3.1.0a2
  - 3.1.0a3
  - 3.1.0a4
  - 3.1.0a5
  - 3.1.1
  ecosystem_specific: {}
references:
- type: ADVISORY
  url: https://github.com/nautobot/nautobot/releases/tag/v2.4.33
- type: ADVISORY
  url: https://github.com/nautobot/nautobot/releases/tag/v3.1.2
- type: FIX
  url: https://github.com/nautobot/nautobot/commit/5a30d0916953afbeedd24a784709e762cc3879cd
- type: FIX
  url: https://github.com/nautobot/nautobot/commit/c2b766966d814a7141f62c7bc90c85fefb7892ee
- type: FIX
  url: https://github.com/nautobot/nautobot/security/advisories/GHSA-qrpw-gjvh-x5gm
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H