Home / Vulnerability Intelligence / CVE-2026-29856

CVE-2026-29856 - Vulnerability Analysis

HighCVSS: 7.5

Last Updated: March 19, 2026

aaPanel - Denial of Service

Published: March 18, 2026Updated: March 19, 2026PoC AvailableRemote Exploitable

Overview

aaPanel v7.57.0 contains a Regular Expression Denial of Service caused by improper VirtualHost configuration parsing, letting attackers cause denial of service via crafted input, exploit requires no special privileges.

Severity & Score

Severity: High

CVSS Score: 7.5

EPSS Score: 3.8%(Probability of exploitation in next 30 days)

Impact

Attackers can cause denial of service by exhausting server resources through crafted input.

Mitigation

Update to the latest version of aaPanel.

References

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

Mar 19, 2026

🟠 CVE-2026-29856 - High (7.5) An issue in the VirtualHost configuration handling/parser component of aaPanel v7.57.0 allows attackers to cause a Regular Expression Denial of Service (ReDoS) via a crafted input. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29856/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

Mar 19, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-29856
Severity: High
CVSS Score: 7.5
Type: denial_of_service
Status: confirmed
EPSS: 3.8%
Social Posts: 2

CWE

CWE-400

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

3.8%Probability of exploitation in the next 30 days