[Snyk] Regular Expression Denial of Service sphinx (Medium - Due 6/24/2026)

[exalate-issue-sync]

Introduced through sphinx@4.3.1 and sphinx@7.2.6

Exploit Maturity: Proof-of-Concept

As of 2026-03-25 there is no fix yet.

This issue exists on both the API and the Validator

QA Notes

null

DEV Notes

!image-20260325-204030.png|width=686,alt="image-20260325-204030.png"!

!image-20260325-204410.png|width=1174,alt="image-20260325-204410.png"!

Design

null

See full ticket and images here: FECFILE-2988