CVE-2026-10692

johnhuang316 code-index-mcp search_code_advanced is_safe_regex_pattern redos

State: Published
Severity: 5.3 Medium
Published: Jun 2, 2026
Updated: Jun 3, 2026
Reserved: Jun 2, 2026

Description

A weakness has been identified in johnhuang316 code-index-mcp up to 2.14.0. Affected is the function is_safe_regex_pattern of the component search_code_advanced. Executing a manipulation of the argument regex can lead to inefficient regular expression complexity. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.14.1 is able to address this issue. This patch is called 25bc02fac74051ddae15ce79e952f00211b1ea6b. Upgrading the affected component is recommended.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C	VulDB
3.0	4.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C	VulDB
2.0	4.0 Medium	AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-1333 Inefficient Regular Expression Complexity
CWE-400 Resource Consumption

Affected Products

Product	Versions
code-index-mcpjohnhuang316	2.0Affected 2.1Affected 2.2Affected 2.3Affected 2.4Affected 2.5Affected 2.6Affected 2.7Affected 2.8Affected 2.9Affected 2.10Affected 2.11Affected 2.12Affected 2.13Affected 2.14.0Affected 2.14.1Not affected

References

VDB-367961 | johnhuang316 code-index-mcp search_code_advanced is_safe_regex_pattern redosvdb-entrytechnical-description
VDB-367961 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-10692 | CVE Analysis and Reportthird-party-advisory
Submit #830786 | johnhuang316 code-index-mcp Latest Denial of Servicethird-party-advisory
https://github.com/johnhuang316/code-index-mcp/issues/84exploitissue-tracking
https://github.com/johnhuang316/code-index-mcp/commit/25bc02fac74051ddae15ce79e952f00211b1ea6bpatch
https://github.com/johnhuang316/code-index-mcp/releases/tag/v2.14.1patch
https://github.com/johnhuang316/code-index-mcp/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.