EUVD-2026-104597
GHSA-w53r-mv8r-wgxx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit crafted config input to exposed parser
-
ExploitTrigger catastrophic backtracking in _sectionmarker regex
-
ImpactExhaust CPU causing denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Regex complexity limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that an application using configobj (versions up to 5.0.9) passes attacker-influenced input into the config-parsing path that reaches the _sectionmarker function; a crafted string causing pathological regex backtracking is the trigger. The critical limiting factor is that configobj is a library: if the host application only parses trusted, local, operator-controlled configuration files (the typical deployment), there is no remote attack surface despite AV:N. There is no public patch, so mitigation currently depends on input validation, parse timeouts, or restricting parser exposure. No authentication or user interaction is required at the configobj layer itself (PR:N/UI:N). |
| Impact | This is a ReDoS (CWE-1333, inefficient regular expression complexity) in the configobj Python library's _sectionmarker parser, with impact limited strictly to availability (VA:L; confidentiality and integrity are N). The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) yields 6.9 (Medium) and implies unauthenticated remote reachability with low complexity. However, no EPSS score, KEV listing, or POC is present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - the signals converge on a low-urgency issue rather than an active threat. The AV:N rating is the key point of caution: configobj is a library that parses config data, so 'remote' exploitation is only real when an application feeds attacker-controlled input into the parser; in the common case where only trusted local config files are parsed, the practical vector is closer to local/non-remote. Reported solely by VulDB with the upstream project unresponsive (no patch), this is a genuine-but-low-priority availability bug, not a high-severity emergency. |
| Exploit ScenarioDerived | An attacker identifies an application that parses user-supplied or uploaded data through configobj and submits a crafted config string that triggers catastrophic backtracking in the _sectionmarker regular expression. The worker thread pins CPU on the pathological input, degrading or denying service for other users. No public exploit code was identified in the provided data, and success depends entirely on the application exposing the parser to untrusted input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
A regular-expression denial-of-service (ReDoS) flaw in DiffSK configobj through version 5.0.9 lets remote attackers stall Python applications that parse untrusted configuration text, because the _sectionmarker routine in configobj/__init__.py builds a regex vulnerable to catastrophic backtracking. Impact is confined to availability (low-severity availability loss, no confidentiality or integrity effect); unauthenticated attackers can trigger it whenever attacker-influenced input reaches the parser. No vendor patch has been identified at time of analysis - the issue was filed upstream (GitHub issue #281) but the project has not responded, and no public exploit code was identified at time of analysis. Exploitation is highly context-dependent: typical deployments that only parse local, operator-controlled config files expose no remote surface.
RemediationAI
No vendor-released patch has been identified at time of analysis; the maintainers were notified via GitHub issue https://github.com/DiffSK/configobj/issues/281 and have not yet responded, so remediation must be compensating rather than version-based. Highest-value control: stop feeding untrusted strings into ConfigObj - audit every call site and ensure only operator-controlled configuration files reach the parser, which eliminates the remote surface entirely at the cost of redesign work where user-editable config is a required feature. Where untrusted parsing cannot be avoided, enforce strict input length and character allowlists on section headers before parsing (reject inputs over a small byte cap or containing repeated '[' / ']' / quoting characters), wrap parse calls in a hard timeout (signal.alarm, multiprocessing with join timeout, or a worker with a watchdog) so a runaway regex is killed rather than allowed to pin a worker, and run parsing in a resource-limited process (RLIMIT_CPU, cgroup CPU quota, low concurrency pool) to cap blast radius - each of these adds latency or operational complexity and none fixes the underlying backtracking. Monitor https://github.com/DiffSK/configobj/ for an upstream fix commit or release and upgrade as soon as a patched version is published; until then, treat any exposed endpoint that parses user-supplied config as a CPU-exhaustion risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
configobj is a long-standing pure-Python library for reading and writing INI-style configuration files, widely used as a dependency of application frameworks and tooling that ingest user-supplied config text. The flaw is CWE-1333 (inefficient regular expression complexity): the _sectionmarker routine in configobj/__init__.py composes/compiles a regular expression whose alternatives and nested quantifiers permit exponential backtracking on certain malformed section headers. A short crafted input with many ambiguous delimiters or repeated partial section markers forces the regex engine into pathological backtracking, pinning a CPU core for an unbounded time and starving the hosting service (CPU exhaustion DoS). Because the vulnerable surface is a library API rather than a network daemon, the CVSS AV:N rating reflects the fact that input can arrive over the network in web/service integrations - but the actual attack surface exists only where an application feeds externally controlled strings (uploads, API payloads, user-editable config blobs, CI templates) into ConfigObj parsing. Applications that parse only locally administered files are not remotely reachable. No authentication or user interaction is required at the library layer (PR:N/UI:N in both the CVSS 4.0 and the assessed CVSS 3.1 vector).
Know when Configobj gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
ReDoS affecting availability only (A:L, C/I:N); AV:N and PR:N retained to match the library's potential exposure to untrusted input, though real reachability is application-dependent.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function _sectionmarker of the file configobj/__init__.py. The manipulation leads to inefficient regular expression complexity. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB