Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled (security.twig_content.process_enabled: true, disabled by default), an authenticated page editor can supply a catastrophically backtracking PCRE pattern that is passed directly to PHP's preg_replace(), causing unbounded CPU consumption and denial of service to the web server process.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-62237 Regular Expression Denial of Service in Grav Before 2.0.4 Twig Filter https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-62237
Post summary
CVE-2026-62237 is a Regular Expression Denial of Service vulnerability affecting Grav before version 2.0.4 in the Twig Filter; no PoC, exploit, active exploitation, or patch information is provided.