CVE-2026-112300

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-112300", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-10-19T14:04:49.020Z", "datePublished": "2026-10-19T20:30:18.020Z", "dateUpdated": "2026-10-20T16:09:34.927Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-19T20:30:18.020Z"}, "title": "DiffSK configobj __init__.py _sectionmarker redos", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-1333", "lang": "en", "description": "Inefficient Regular Expression Complexity"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-400", "lang": "en", "description": "Resource Consumption"}]}], "affected": [{"vendor": "DiffSK", "product": "configobj", "versions": [{"version": "5.0.0", "status": "affected"}, {"version": "5.0.1", "status": "affected"}, {"version": "5.0.2", "status": "affected"}, {"version": "5.0.3", "status": "affected"}, {"version": "5.0.4", "status": "affected"}, {"version": "5.0.5", "status": "affected"}, {"version": "5.0.6", "status": "affected"}, {"version": "5.0.7", "status": "affected"}, {"version": "5.0.8", "status": "affected"}, {"version": "5.0.9", "status": "affected"}], "cpes": ["cpe:2.3:a:diffsk:configobj:*:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function _sectionmarker of the file configobj/__init__.py. The manipulation leads to inefficient regular expression complexity. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:ND/RC:C"}}], "timeline": [{"time": "2026-10-19T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-10-19T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-10-19T16:09:53.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Mohammedix88 (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/422346", "name": "VDB-422346 | DiffSK configobj __init__.py _sectionmarker redos", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/422346/cti", "name": "VDB-422346 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-112300", "name": "CVE-2026-112300 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/989395", "name": "Submit #989395 | DiffSK configobj 5.0.9 Denial of Service", "tags": ["third-party-advisory"]}, {"url": "https://github.com/DiffSK/configobj/issues/281", "tags": ["issue-tracking"]}, {"url": "https://github.com/DiffSK/configobj/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202610"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-20T15:18:59.728457Z", "id": "CVE-2026-112300", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T16:09:34.927Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-112300", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-20T15:18:59.728457Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-20T15:19:00.577Z"}}], "cna": {"title": "DiffSK configobj __init__.py _sectionmarker redos", "credits": [{"lang": "en", "type": "reporter", "value": "Mohammedix88 (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:ND/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:diffsk:configobj:*:*:*:*:*:*:*:*"], "vendor": "DiffSK", "product": "configobj", "versions": [{"status": "affected", "version": "5.0.0"}, {"status": "affected", "version": "5.0.1"}, {"status": "affected", "version": "5.0.2"}, {"status": "affected", "version": "5.0.3"}, {"status": "affected", "version": "5.0.4"}, {"status": "affected", "version": "5.0.5"}, {"status": "affected", "version": "5.0.6"}, {"status": "affected", "version": "5.0.7"}, {"status": "affected", "version": "5.0.8"}, {"status": "affected", "version": "5.0.9"}]}], "timeline": [{"lang": "en", "time": "2026-10-19T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-10-19T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-10-19T16:09:53.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/422346", "name": "VDB-422346 | DiffSK configobj __init__.py _sectionmarker redos", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/422346/cti", "name": "VDB-422346 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-112300", "name": "CVE-2026-112300 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/989395", "name": "Submit #989395 | DiffSK configobj 5.0.9 Denial of Service", "tags": ["third-party-advisory"]}, {"url": "https://github.com/DiffSK/configobj/issues/281", "tags": ["issue-tracking"]}, {"url": "https://github.com/DiffSK/configobj/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202610"], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function _sectionmarker of the file configobj/__init__.py. The manipulation leads to inefficient regular expression complexity. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1333", "description": "Inefficient Regular Expression Complexity"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "Resource Consumption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-19T20:30:18.020Z"}}}, "cveMetadata": {"cveId": "CVE-2026-112300", "state": "PUBLISHED", "dateUpdated": "2026-10-20T16:09:34.927Z", "dateReserved": "2026-10-19T14:04:49.020Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-10-19T20:30:18.020Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:diffsk:configobj:*:*:*:*:*:*:*:*"], "product": "configobj", "vendor": "DiffSK", "versions": [{"status": "affected", "version": "5.0.0"}, {"status": "affected", "version": "5.0.1"}, {"status": "affected", "version": "5.0.2"}, {"status": "affected", "version": "5.0.3"}, {"status": "affected", "version": "5.0.4"}, {"status": "affected", "version": "5.0.5"}, {"status": "affected", "version": "5.0.6"}, {"status": "affected", "version": "5.0.7"}, {"status": "affected", "version": "5.0.8"}, {"status": "affected", "version": "5.0.9"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function _sectionmarker of the file configobj/__init__.py. The manipulation leads to inefficient regular expression complexity. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet."}], "id": "CVE-2026-112300", "lastModified": "2026-10-20T19:27:34.430", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-112300", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-20T15:18:59.728457Z", "version": "2.0.3"}}]}, "published": "2026-10-19T21:17:06.677", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/DiffSK/configobj/"}, {"source": "cna@vuldb.com", "url": "https://github.com/DiffSK/configobj/issues/281"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-112300"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/989395"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/422346"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/422346/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-1333"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "configobj: configobj: Denial of Service via inefficient regular expression evaluation", "id": "2555850", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555850"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-1333", "details": ["A flaw was found in configobj. A remote attacker can trigger a Denial of Service (DoS) by supplying specially crafted configuration input to be parsed by the application. Due to inefficient regular expression evaluation in the _sectionmarker function, processing this input causes excessive CPU consumption and application unresponsiveness."], "name": "CVE-2026-112300", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "python-configobj", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "python-configobj", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "python-configobj", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-19T20:30:18Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-112300\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-112300\nhttps://github.com/DiffSK/configobj/\nhttps://github.com/DiffSK/configobj/issues/281\nhttps://vuldb.com/cve/CVE-2026-112300\nhttps://vuldb.com/submit/989395\nhttps://vuldb.com/vuln/422346\nhttps://vuldb.com/vuln/422346/cti"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.0.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.0.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.0.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.0.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.0.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.0.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.0.9"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "configobj", "source": "cna", "vendor": "DiffSK"}, "product": "configobj", "vendor": "diffsk"}], "created": "2026-10-19T21:45:04.254258+00:00", "updated": "2026-10-21T16:47:34.899615+00:00", "vendors": ["diffsk", "diffsk$PRODUCT$configobj"]}