colord EUVD-2026-70736

The target application must accept a string from an external source - HTTP request body field, JSON property, uploaded stylesheet, or any other untrusted channel - and pass it without length restriction to one of the following colord API functions: colord(), getFormat(), isEqual(), mix(), or contrast(). The attack requires no authentication if the accepting endpoint is unauthenticated (PR:N per CVSS vector). Exploitation is limited to JavaScript/Node.js runtime environments where colord processes color strings synchronously on the event loop; serverless or multi-process worker deployments reduce but do not eliminate impact, since individual workers can each be blocked. The payload must be several kilobytes of repeated digit characters wrapped in a CSS color-function shell (e.g., hsl(1111...1, 50%, 50%)) - valid-length CSS color strings (under ~100 bytes) cannot trigger meaningful delay.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms unauthenticated, low-complexity network exploitability with no special attack requirements. The assigned VA:L in the provided vector may understate real-world severity: a fully blocked Node.js event loop is functionally equivalent to a complete service outage for all concurrent requests, not merely degraded performance, and under sustained attack a single worker thread can be kept permanently occupied. Even a mid-sized municipal IT team in bytom running an internal design or CSS-processing tool built on colord should treat this as urgent if the tool accepts color strings from untrusted sources. The test code added in the fix PR (tests/parse-complexity.test.ts) demonstrates that a 64,000-character malformed payload required 'several seconds' pre-fix against a budget of 500ms, confirming practical exploitability. No EPSS score or CISA KEV listing is present in the source intelligence, making widespread automated exploitation unlikely at this time; however, the attack payload is trivially constructable from the vulnerability description alone. Risk is highest in applications that directly pipe HTTP request parameters or uploaded stylesheets into colord without length bounds.

An attacker submits a POST request to a web application theme-customizer or CSS-validation endpoint, supplying a malformed color value such as rgb( followed by 64,000 digit characters and a closing ). The server passes the string to colord() for validation; the synchronous regex engine spends several seconds exhausting O(n²) backtracking combinations before rejecting it. Repeated rapid submissions hold the event loop continuously blocked, making the server unresponsive to all other traffic for the duration of the attack. No public exploit code has been identified at time of analysis, but the payload structure is directly derivable from the vulnerability description.