ReDoS Vulnerability in Flag Forge CTF Platform Affecting User Profile API

CVE-2026-21868

What is CVE-2026-21868?

Flag Forge, a Capture The Flag (CTF) platform, contains a vulnerability in its user profile API endpoint, allowing an attacker to exploit a Regular Expression Denial of Service (ReDoS). This occurs because the application improperly constructs a regular expression using unescaped user input from the username parameter. By sending a specially crafted username that includes regex meta-characters, an attacker can cause the MongoDB regex engine to consume excessive CPU resources, resulting in disrupted service for legitimate users. The vulnerability has been resolved in version 2.3.3. As a precaution, it is advisable to implement a Web Application Firewall (WAF) rule to block requests containing regex meta-characters in the URL path.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References