Loguru
Monthly
Catastrophic backtracking in loguru's ANSI color-markup parser (AnsiParser.feed in loguru/_colorizer.py, with the CPE covering 0.7.3 and, as a wildcard range, other versions) lets an attacker who can get crafted text into a colorized log message exhaust CPU and degrade availability. Reachability is integration-specific: only host applications that route attacker-controlled strings through the colorization/markup path with markup enabled are exposed, which is why our assessed vector rates attack complexity High with Availability-only impact. There is no CISA KEV entry; the disclosure states the exploit is now public, but that has not been verified as working exploit code, and the vendor did not respond to the report, so no fixed version is identified at time of analysis.
Catastrophic backtracking in loguru's ANSI color-markup parser (AnsiParser.feed in loguru/_colorizer.py, with the CPE covering 0.7.3 and, as a wildcard range, other versions) lets an attacker who can get crafted text into a colorized log message exhaust CPU and degrade availability. Reachability is integration-specific: only host applications that route attacker-controlled strings through the colorization/markup path with markup enabled are exposed, which is why our assessed vector rates attack complexity High with Availability-only impact. There is no CISA KEV entry; the disclosure states the exploit is now public, but that has not been verified as working exploit code, and the vendor did not respond to the report, so no fixed version is identified at time of analysis.