{"metadata": {"vulnerability": "CVE-2026-59966", "count": 10, "kinds": {"milestone": 3, "sighting": 1, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-07-07T18:49:15.608Z", "date_only": false, "value": "2026-07-07T18:49:15.608Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-59966", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-16T19:18:57.453Z", "date_only": false, "value": "2026-10-16T19:18:57.453Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-59966", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T19:18:57.453Z", "date_only": false, "value": "2026-10-16T19:18:57.453Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-59966", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T19:28:08.580Z", "date_only": false, "value": "2026-10-16T19:28:08.580084Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117452235605074593", "record": "CVE-2026-59966", "field": "creation_timestamp", "uuid": "c74bdb14-8202-4257-92c9-1a7e049ce26b", "content": "CVE-2026-59966 Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout when an authenticated user stores a catastrophic-backtracking regex and any user in the same Space imports a matching recipe. Request processing uses Automation.param_2, apply_regex_replace_automation, sub, api/recipe-from-source/. The attack works because the shared-Space automation engine evaluates the malicious pattern during recipe import and can occupy a Gunicorn worker until its request timeout. This can exhaust application worker slots and make the service unavailable to users. This issue is fixed in version 2.6.10.\nhttps://www.cve.org/CVERecord?id=CVE-2026-59966https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-f2gw-c2c7-59v7https://github.com/TandoorRecipes/recipes/commit/adc2732712819d7fe26a9f74f6b0271c1a9d87c3https://github.com/TandoorRecipes/recipes/releases/tag/2.6.10#TandoorRecipes #recipes#CVE_2026_59966#bot", "url": "https://infosec.exchange/users/cve/statuses/117452235605074593"}, {"timestamp": "2026-10-16T19:39:45.918Z", "date_only": false, "value": "2026-10-16T19:39:45.918792Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-59966", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T19:39:45.918Z", "date_only": false, "value": "2026-10-16T19:39:45.918792Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-59966", "record": "FKIE_CVE-2026-59966", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T19:40:13.402Z", "date_only": false, "value": "2026-10-16T19:40:13.402Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-59966", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T19:40:13.402Z", "date_only": false, "value": "2026-10-16T19:40:13.402Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-59966", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T20:17:23.700Z", "date_only": false, "value": "2026-10-16T20:17:23.700", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-59966", "record": "FKIE_CVE-2026-59966", "field": "published"}, {"timestamp": "2026-10-19T20:52:47.340Z", "date_only": false, "value": "2026-10-19T20:52:47.340", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-59966", "record": "FKIE_CVE-2026-59966", "field": "lastModified"}]}