Regex Denial of Service Vulnerability in Sync-in Server by Sync-in
CVE-2026-58270

6.5MEDIUM

Key Information:

Vendor

Sync-in

Status
Server
Vendor
CVE Published:
21 September 2026

What is CVE-2026-58270?

The Sync-in Server is an open-source platform for file storage and collaboration that is vulnerable to a Denial of Service (DoS) attack due to a flaw in its sync diff endpoint. Prior to version 2.4.0, this endpoint improperly compiles user-supplied strings into a regular expression without adequate complexity validation. A crafted input string can lead to catastrophic backtracking, resulting in the Node.js event loop becoming unresponsive. This condition effectively halts the server, affecting all users until a manual restart of the container is performed. Version 2.4.0 has been released to address and patch this vulnerability.

Affected Version(s)

server < 2.4.0

References

https://github.com/Sync-in/server/security/advisories/GHS...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.