CVE-2026-72912

MEDIUM 4.3

CyberChef’s pretty-recipe parser vulnerable to client-side ReDoS / CPU exhaustion when parsing a malformed #recipe= URL

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, CyberChef's pretty-recipe parser in src/core/Utils.mjs can exhaust client-side CPU when a malformed #recipe= URL fragment containing a large number of unmatched quote characters reaches Utils.parseRecipeConfig(). The function synchronously applies a complex global regular expression that may perform heavy backtracking before rejecting the input, causing the victim's browser tab to freeze during startup for seconds or longer. No code execution, data exfiltration, or privilege escalation occurs. This issue is fixed in version 11.3.0.

CWE	CWE-400 CWE-1333
Vendor	gchq
Product	cyberchef
Published	Aug 10, 2026

Stay Ahead of the Next One

Get instant alerts for gchq cyberchef

Be the first to know when new medium vulnerabilities affecting gchq cyberchef are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

gchq / CyberChef

< 11.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/gchq/CyberChef/security/advisories/GHSA-w74r-jxjh-gwr6 github.com: https://github.com/gchq/CyberChef/pull/2687 github.com: https://github.com/gchq/CyberChef/commit/f77ddf489050b339faa978bb28da954bafd289ae github.com: https://github.com/gchq/CyberChef/releases/tag/v11.3.0