p PatchFirst

CVE-2026-112300

CVE-2026-112300 · DiffSK configobj __init__.py _sectionmarker redos

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function _sectionmarker of the file configobj/__init__.py. The manipulation leads to inefficient regular expression complexity. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 6.9 · Medium · EPSS 0.4%

Published
Updated

Stack: system

Affected products and versions

  • configobj

    Versions
    • 5.0.0: Affected
    • 5.0.1: Affected
    • 5.0.2: Affected
    • 5.0.3: Affected
    • 5.0.4: Affected
    • 5.0.5: Affected
    • 5.0.6: Affected
    • 5.0.7: Affected
    • 5.0.8: Affected
    • 5.0.9: Affected

    No fix published

  • configobj Debian:12

    Versions
    • 5.0.8-1
    • 5.0.8-2
    • 5.0.8-3
    • 5.0.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • configobj Debian:13

    Versions
    • 5.0.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • configobj Debian:14

    Versions
    • 5.0.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • configobj Ubuntu:Pro:14.04:LTS

    Versions
    • 4.7.2+ds-5
    • 4.7.2+ds-5build1
    • 4.7.2+ds-5ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • configobj Ubuntu:Pro:16.04:LTS

    Versions
    • 5.0.6-2
    • 5.0.6-2ubuntu0.16.04.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • configobj Ubuntu:Pro:18.04:LTS

    Versions
    • 5.0.6-2
    • 5.0.6-2ubuntu0.18.04.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • configobj Ubuntu:20.04:LTS

    Versions
    • 5.0.6-3
    • 5.0.6-3build1
    • 5.0.6-4
    • 5.0.6-4ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • configobj Ubuntu:22.04:LTS

    Versions
    • 5.0.6-4
    • 5.0.6-5
    • 5.0.6-5ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • configobj Ubuntu:24.04:LTS

    Versions
    • 5.0.8-2
    • 5.0.8-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • configobj Ubuntu:26.10

    Versions
    • 5.0.9-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • configobj Ubuntu:26.04:LTS

    Versions
    • 5.0.9-1
    • 5.0.9-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →