CVE-2023-26112: configobj ReDoS exploitable by developer using values in a server-side configuration file
3.7
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.20242%
CWE
Published
4/3/2023
Updated
12/16/2024
KEV Status
No
Technology
Python
PythonTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| configobj | pip | < 5.0.9 | 5.0.9 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The commit diff shows the _func_re regex in Validator class was patched to prevent ReDoS. The test_re_dos() in test_validate_errors.py demonstrates exploitation via val.check(), confirming the check method processes attacker-controlled input using the vulnerable regex. The CVE description explicitly ties the vulnerability to the validate function's regex parsing, which is implemented in Validator's validation logic.