EUVD-2026-114785
GHSA-h6r7-8xvv-hr33
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted ANSI color-markup string
-
ExploitApplication logs it through loguru colorizer
-
ExecutionCatastrophic regex backtracking in AnsiParser.feed
-
ImpactCPU exhaustion degrades availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Regex complexity limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the host application to pass attacker-controlled text into loguru's ANSI color-markup parser with colorization/markup enabled (e.g. logging user input through a colorized format that AnsiParser.feed processes). The limiting factors are therefore integration-specific: if the application never logs untrusted input through the color-markup path, the flaw is not reachable. Impact is confined to availability (CPU exhaustion via catastrophic backtracking); there is no confidentiality or integrity effect. No fixed version or vendor mitigation is available, as the vendor did not respond to the disclosure. |
| Impact | Signals are modest and mostly consistent. The VulDB-assigned CVSS 4.0 vector (5.3, Medium) describes a remote, low-complexity issue with low availability impact only (VA:L; VC:N/VI:N) and PR:L - a denial-of-service bug, not a compromise. Exploit maturity is E:P (proof-of-concept), matching the description's claim that an exploit is public. No CISA KEV listing and no EPSS score are present in the supplied data, so there is no evidence of widespread or automated exploitation; the vuln.today Decision label is 'this_month', i.e. a scheduled-patch priority rather than act_now/emergency. One tension to verify: the vector states PR:L, but loguru is a library with no authentication of its own - real reachability depends entirely on whether the host application feeds attacker-controlled text into loguru's color-markup parser, so the privilege requirement is an artifact of the embedding application, not the flaw itself. Net: a genuine but limited availability issue (CPU exhaustion), worth remediating on a normal cadence; it is not a high-urgency, pre-auth RCE despite the 'remote' attack vector. |
| Exploit ScenarioDerived | An application uses loguru to log user-supplied text with color markup enabled and routes attacker-controlled input through it. The attacker submits a crafted ANSI color-markup string that triggers catastrophic regular-expression backtracking in AnsiParser.feed, pinning a CPU core and degrading or stalling the service. The description states a public exploit exists, though the supplied references are VulDB pages rather than verified working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 01, 2026
Catastrophic backtracking in loguru's ANSI color-markup parser (AnsiParser.feed in loguru/_colorizer.py, with the CPE covering 0.7.3 and, as a wildcard range, other versions) lets an attacker who can get crafted text into a colorized log message exhaust CPU and degrade availability. Reachability is integration-specific: only host applications that route attacker-controlled strings through the colorization/markup path with markup enabled are exposed, which is why our assessed vector rates attack complexity High with Availability-only impact. There is no CISA KEV entry; the disclosure states the exploit is now public, but that has not been verified as working exploit code, and the vendor did not respond to the report, so no fixed version is identified at time of analysis.
RemediationAI
No vendor-released patch is identified at time of analysis: loguru's maintainer was contacted about the disclosure and did not respond, so there is no fixed version to cite and no vendor advisory describing a workaround. Until an upstream fix appears, the most direct control is to turn off ANSI colorization/markup on any sink that can receive untrusted input, so AnsiParser.feed is never invoked on attacker-controlled text - the trade-off is loss of colored and tag-annotated log output on those sinks. Where colored output must be kept, sanitize or escape markup metacharacters in externally supplied strings before they are logged, or route such values through a non-colorized sink, accepting the extra processing step and the risk that escaping misses a character the parser treats specially. Additional compensating measures include capping the length of individual log messages and rate-limiting log volume from untrusted sources, which bounds the CPU a single catastrophic-backtracking input can consume at the cost of truncating or dropping log data, and isolating logging-heavy workloads under CPU limits so a backtracking stall cannot starve co-located processes. Monitor https://vuldb.com/vuln/429568 and https://vuldb.com/vuln/429568/cti for updated patch information; this item is tracked at a this_month priority rather than as an emergency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
loguru is a widely used Python logging library that can emit colorized console output and supports an ANSI markup syntax in which tags inside a log message are translated into ANSI escape sequences. That translation is performed by the AnsiParser class in loguru/_colorizer.py, and the reported weakness is CWE-1333 (inefficient regular expression complexity) in AnsiParser.feed: a crafted input string can drive the regular-expression engine into excessive backtracking, consuming CPU for the duration of the match attempt. Because loguru is a library rather than a service, the attack surface is defined entirely by the embedding application - the flaw is only reachable when untrusted text is logged through a format that the color-markup parser processes. The available sources do not identify the specific regex or the exact tag sequence that causes the blowup; the trigger is not described beyond the named entry point, and no confidentiality or integrity effect is associated with it. Note that the published CVSS 4.0 vector records PR:L while our assessed CVSS 3.1 vector records PR:N with AC:H; the library itself implements no authentication, so the effective privilege requirement is whatever the host application enforces before a string reaches a colorized sink.
Know when Loguru gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
ReDoS causes only partial CPU-based availability loss (A:L); AC:H because success depends on the application feeding attacker-controlled markup into loguru with colorization enabled, a condition beyond attacker control.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file loguru/_colorizer.py of the component ANSI Color-Markup Parser. Performing a manipulation results in inefficient regular expression complexity. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB