{"id":"CVE-2026-112300","kind":"vulnerability","aliases":["CVE-2026-112300"],"related":[],"title":"configobj: regex in _sectionmarker can be slowed to cause denial of service","description":"A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function _sectionmarker of the file configobj/__init__.py. The manipulation leads to inefficient regular expression complexity. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.","summary":"configobj up to 5.0.9 has a regular expression in its _sectionmarker function with inefficient complexity. A crafted config input can make parsing consume excessive CPU, which can stall the application.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["configobj","package","python"],"not_affected_if":["no-untrusted-parsing","trusted-input-only"],"how_to_check":"- `pip show configobj` to see the installed version\n- Check whether the application parses untrusted input with configobj","fix":null,"status":"open","published_at":"2026-10-19T21:17:06+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T03:40:41+00:00","updated_at":"2026-10-25T03:40:41+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:40:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"configobj: regex in _sectionmarker can be slowed to cause denial of service","impact":"low","summary":"configobj up to 5.0.9 has a regular expression in its _sectionmarker function with inefficient complexity. A crafted config input can make parsing consume excessive CPU, which can stall the application.","category":"package","nicknames":[],"who_cares":["python","configobj"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Parsing hangs on crafted input, causing denial of service","analyst_note":"Confirm whether any patched configobj release exists and which inputs reach _sectionmarker in practice; the source is only the NVD entry.","how_to_check":"- `pip show configobj` to see the installed version\n- Check whether the application parses untrusted input with configobj","needs_analyst":true,"not_affected_if":["trusted-input-only","no-untrusted-parsing"],"who_is_affected":"Applications that parse configobj files from untrusted sources can be slowed down by crafted input. Applications that only read trusted local config files are unlikely to be exposed. The project had not responded to the report when the advisory was published, so no patched release is confirmed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000559,"input_tokens":3324,"output_tokens":454,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112300':15A,18A '-2026':14A,17A '5.0.9':25B,61C 'affect':62C 'applic':51B 'attack':86C 'caus':9A 'complex':36B,81C 'config':39B 'configobj':1A,19B,22B,58C 'configobj/__init__.py':73C 'consum':44B 'cpu':46B 'craft':38B 'cve':13A,16A 'denial':10A 'diffsk':57C 'earli':96C 'excess':45B 'exploit':83C 'express':29B,80C 'file':72C 'function':33B,68C 'identifi':55C 'ineffici':35B,78C 'inform':92C 'input':40B 'issu':99C 'lead':76C 'make':42B 'manipul':75C 'packag':20B 'pars':43B 'possibl':88C 'problem':95C 'project':90C 'python':21B 'regex':2A 'regular':28B,79C 'remot':82C 'report':100C 'respond':104C 'sectionmark':4A,32B,69C 'servic':12A 'slow':7A 'stall':49B 'vulner':53C,65C 'yet':105C","nicknames":[],"mitigations":[],"who_affected":"Applications that parse configobj files from untrusted sources can be slowed down by crafted input. Applications that only read trusted local config files are unlikely to be exposed. The project had not responded to the report when the advisory was published, so no patched release is confirmed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T21:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112300","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112300","severity":null,"published_at":"2026-10-19T21:17:06+00:00","modified_at":"2026-10-20T19:27:34+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}