Live › vulnerability › CVE-2026-120217
Loguru 0.7.3's ANSI color-markup parser (AnsiParser.feed) uses a regular expression that becomes very slow on crafted input. A remote attacker can send messages that tie up CPU while the library parses them.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 07:18 UTC. All times on this page are UTC.
Applications that use loguru 0.7.3 and log attacker-controlled text with color markup parsing enabled are the ones exposed. Services that only log trusted internal strings have less exposure. The sources do not say which loguru versions are fixed.
No product ranges from the sources yet.
pip show loguru or python -c "import loguru; print(loguru.__version__)".No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file loguru/_colorizer.py of the component ANSI Color-Markup Parser. Performing a manipulation results in inefficient regular expression complexity. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-120217")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.