---
id: CVE-2026-59966
title: >-
  Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via
  User-Controlled Automation Regex Patterns
summary: >-
  Tandoor Recipes is an application for managing recipes, planning meals, and
  building shopping lists. Prior to 2.6.10, executes user-controlled Automation
  regular-expression patterns with Python re.sub() without complexity validation
  or a…
severity: medium
cvss: 5.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-1333
vendor: TandoorRecipes
product: recipes
affected:
  - recipes < 2.6.10
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T19:39:45.918792Z'
exploitAvailable: true
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:40:13.402Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-59966'
references:
  - url: >-
      https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-f2gw-c2c7-59v7
    label: >-
      https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-f2gw-c2c7-59v7
  - url: >-
      https://github.com/TandoorRecipes/recipes/commit/adc2732712819d7fe26a9f74f6b0271c1a9d87c3
    label: >-
      https://github.com/TandoorRecipes/recipes/commit/adc2732712819d7fe26a9f74f6b0271c1a9d87c3
  - url: 'https://github.com/TandoorRecipes/recipes/releases/tag/2.6.10'
    label: 'https://github.com/TandoorRecipes/recipes/releases/tag/2.6.10'
tags:
  - cve.org
  - exploit-available
ingestedAt: '2026-10-16T19:46:24.325Z'
---

## Overview

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout when an authenticated user stores a catastrophic-backtracking regex and any user in the same Space imports a matching recipe. Request processing uses Automation.param_2, apply_regex_replace_automation, sub, api/recipe-from-source/. The attack works because the shared-Space automation engine evaluates the malicious pattern during recipe import and can occupy a Gunicorn worker until its request timeout. This can exhaust application worker slots and make the service unavailable to users. This issue is fixed in version 2.6.10.

## Affected

- `recipes < 2.6.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.