Denial of Service Vulnerability in Tandoor Recipes Application

CVE-2026-59966

What is CVE-2026-59966?

Tandoor Recipes, designed for recipe management and meal planning, is vulnerable to a denial of service attack. An authenticated user can create malicious regular-expression patterns that, when processed during recipe imports within a shared Space, can lead to catastrophic backtracking. This issue stems from the absence of complexity validation and execution timeouts in the automation engine, potentially occupying Gunicorn workers indefinitely and exhausting available worker slots. Users should upgrade to version 2.6.10 to mitigate this issue.

References