CVE-2024-46242
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
In CTFd 3.7.3, the validate_email function in CTFd/utils/validators/__init__.py is vulnerable to a Regular expression Denial of Service (ReDoS) attack. An attacker can supply a crafted email address during registration, causing excessive server load.
Risk Assessment
The risk is that an attacker can perform a DoS attack on the CTFd server by sending a specially crafted string as an email address, potentially making the service unavailable to other users.
Recommendation
It is recommended to immediately update CTFd to the latest version that includes a fix for this vulnerability. If an update is not possible, temporarily restrict email validation or implement alternative filtering mechanisms.
Other vulnerabilities in CTFd
See all- CVE-2025-29419Low risk· EPSS 4%
CTFd v3.7.6 was discovered to be vulnerable to a man-in-the-middle attack.
- CVE-2026-78145Medium
A vulnerability in CTFd up to 3.8.4 in the _is_safe_url function of the CTFd/utils/validators/__init__.py file. Manipulation of the Next argument leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch name is 5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9. Upgrading the affected component is recommended.
Original NVD description (English source)
An issue in the validate_email function in CTFd/utils/validators/__init__.py of CTFd 3.7.3 allows attackers to cause a Regular expression Denial of Service (ReDoS) via supplying a crafted string as e-mail address during registration.