GROWI ReDoS Vulnerability (CVE-2026-41040) Poses High DoS Risk

The National Vulnerability Database has disclosed CVE-2026-41040, a high-severity regular expression denial of service (ReDoS) vulnerability affecting GROWI, a wiki platform provided by GROWI, Inc. Rated with a CVSS score of 7.5, this flaw allows an unauthenticated attacker to trigger a denial-of-service condition by supplying a specially crafted input string.

ReDoS vulnerabilities are insidious because they exploit the computational complexity of certain regular expressions when processing malicious input. A seemingly innocuous string can force the regex engine into an exponentially long processing loop, consuming all available CPU resources and rendering the application unresponsive. For GROWI, this means an attacker could effectively take the wiki offline with minimal effort.

This isn’t just a nuisance; it’s a direct operational impact. Any organization relying on GROWI for critical documentation, collaboration, or knowledge management faces a tangible risk of service disruption. Defenders need to understand that the attacker’s calculus here is simple: maximum impact with low effort. Patching this is non-negotiable.