CVE-2026-55520

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55520", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-16T22:44:22.284Z", "datePublished": "2026-08-28T18:42:38.334Z", "dateUpdated": "2026-08-31T18:54:01.091Z"}, "containers": {"cna": {"title": "Protego: Exponential backtracking ReDoS in robots.txt URL wildcard matching", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1333", "lang": "en", "description": "CWE-1333: Inefficient Regular Expression Complexity", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/scrapy/protego/security/advisories/GHSA-wjmf-p669-5m5p", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/scrapy/protego/security/advisories/GHSA-wjmf-p669-5m5p"}, {"name": "https://github.com/scrapy/protego/commit/785940181659bf440ba82f1da148fade5087e858", "tags": ["x_refsource_MISC"], "url": "https://github.com/scrapy/protego/commit/785940181659bf440ba82f1da148fade5087e858"}, {"name": "https://github.com/scrapy/protego/releases/tag/0.6.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/scrapy/protego/releases/tag/0.6.2"}], "affected": [{"vendor": "scrapy", "product": "protego", "versions": [{"version": "< 0.6.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-28T18:42:38.334Z"}, "descriptions": [{"lang": "en", "value": "Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego._urlpattern._URLPattern._prepare_pattern_for_regex translates every asterisk in an Allow or Disallow directive into a lazy regular-expression wildcard, so a directive containing many asterisks creates exponential backtracking. After protego.Protego.parse processes a crafted robots.txt file, protego.Protego.can_fetch can spend an attacker-controlled period matching a near-miss URL and deny service to the crawler. The vulnerable path is src/protego/_urlpattern.py in the _URLPattern match logic. This issue is fixed in version 0.6.2."}], "source": {"advisory": "GHSA-wjmf-p669-5m5p", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-31T15:42:18.385319Z", "id": "CVE-2026-55520", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-31T18:54:01.091Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55520", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-16T22:44:22.284Z", "datePublished": "2026-08-28T18:42:38.334Z", "dateUpdated": "2026-08-31T18:54:01.091Z"}, "containers": {"cna": {"title": "Protego: Exponential backtracking ReDoS in robots.txt URL wildcard matching", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1333", "lang": "en", "description": "CWE-1333: Inefficient Regular Expression Complexity", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/scrapy/protego/security/advisories/GHSA-wjmf-p669-5m5p", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/scrapy/protego/security/advisories/GHSA-wjmf-p669-5m5p"}, {"name": "https://github.com/scrapy/protego/commit/785940181659bf440ba82f1da148fade5087e858", "tags": ["x_refsource_MISC"], "url": "https://github.com/scrapy/protego/commit/785940181659bf440ba82f1da148fade5087e858"}, {"name": "https://github.com/scrapy/protego/releases/tag/0.6.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/scrapy/protego/releases/tag/0.6.2"}], "affected": [{"vendor": "scrapy", "product": "protego", "versions": [{"version": "< 0.6.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-28T18:42:38.334Z"}, "descriptions": [{"lang": "en", "value": "Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego._urlpattern._URLPattern._prepare_pattern_for_regex translates every asterisk in an Allow or Disallow directive into a lazy regular-expression wildcard, so a directive containing many asterisks creates exponential backtracking. After protego.Protego.parse processes a crafted robots.txt file, protego.Protego.can_fetch can spend an attacker-controlled period matching a near-miss URL and deny service to the crawler. The vulnerable path is src/protego/_urlpattern.py in the _URLPattern match logic. This issue is fixed in version 0.6.2."}], "source": {"advisory": "GHSA-wjmf-p669-5m5p", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55520", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-31T15:42:18.385319Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-31T15:42:19.332Z"}}]}}

{"affected": [{"affectedData": [{"product": "protego", "vendor": "scrapy", "versions": [{"status": "affected", "version": "< 0.6.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego._urlpattern._URLPattern._prepare_pattern_for_regex translates every asterisk in an Allow or Disallow directive into a lazy regular-expression wildcard, so a directive containing many asterisks creates exponential backtracking. After protego.Protego.parse processes a crafted robots.txt file, protego.Protego.can_fetch can spend an attacker-controlled period matching a near-miss URL and deny service to the crawler. The vulnerable path is src/protego/_urlpattern.py in the _URLPattern match logic. This issue is fixed in version 0.6.2."}], "id": "CVE-2026-55520", "lastModified": "2026-09-09T21:09:13.080", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55520", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-31T15:42:18.385319Z", "version": "2.0.3"}}]}, "published": "2026-08-28T20:18:28.100", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/scrapy/protego/commit/785940181659bf440ba82f1da148fade5087e858"}, {"source": "security-advisories@github.com", "url": "https://github.com/scrapy/protego/releases/tag/0.6.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/scrapy/protego/security/advisories/GHSA-wjmf-p669-5m5p"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-1333"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "protego: Protego: Denial of Service via exponential backtracking in robots.txt URL wildcard matching", "id": "2525703", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525703"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1333", "details": ["Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego._urlpattern._URLPattern._prepare_pattern_for_regex translates every asterisk in an Allow or Disallow directive into a lazy regular-expression wildcard, so a directive containing many asterisks creates exponential backtracking. After protego.Protego.parse processes a crafted robots.txt file, protego.Protego.can_fetch can spend an attacker-controlled period matching a near-miss URL and deny service to the crawler. The vulnerable path is src/protego/_urlpattern.py in the _URLPattern match logic. This issue is fixed in version 0.6.2.", "A flaw was found in Protego, a pure-Python robots.txt parser. A remote attacker could exploit this vulnerability by providing a crafted robots.txt file containing numerous asterisks in Allow or Disallow directives. This causes exponential backtracking during URL wildcard matching, leading to a Regular Expression Denial of Service (ReDoS) condition. This can result in the `protego.Protego.can_fetch` function spending an attacker-controlled period matching a URL, thereby denying service to the crawler."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-55520", "public_date": "2026-08-28T18:42:38Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-55520\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-55520\nhttps://github.com/scrapy/protego/commit/785940181659bf440ba82f1da148fade5087e858\nhttps://github.com/scrapy/protego/releases/tag/0.6.2\nhttps://github.com/scrapy/protego/security/advisories/GHSA-wjmf-p669-5m5p"], "statement": "This Moderate denial of service flaw in Protego, a robots.txt parser, does not affect Red Hat products as the vulnerable component is only shipped in Fedora.\nThis vulnerability has been fixed in upstream version 0.6.2.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.6.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "protego", "source": "cna", "vendor": "scrapy"}, "product": "protego", "vendor": "scrapy"}], "created": "2026-08-28T21:00:04.540345+00:00", "updated": "2026-08-31T11:20:10.210637+00:00", "vendors": ["scrapy", "scrapy$PRODUCT$protego"]}