{"id":"CVE-2026-120217","kind":"vulnerability","aliases":["CVE-2026-120217"],"related":[],"title":"loguru: crafted ANSI color markup causes regex slowdown in logging","description":"A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file loguru/_colorizer.py of the component ANSI Color-Markup Parser. Performing a manipulation results in inefficient regular expression complexity. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Loguru 0.7.3's ANSI color-markup parser (AnsiParser.feed) uses a regular expression that becomes very slow on crafted input. A remote attacker can send messages that tie up CPU while the library parses them.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["loguru","package","python"],"not_affected_if":["no-untrusted-input-logged","other-logging-library"],"how_to_check":"- Check the installed loguru version with `pip show loguru` or `python -c \"import loguru; print(loguru.__version__)\"`.\n- Check whether the application passes untrusted input into logger calls that use color markup.","fix":null,"status":"open","published_at":"2026-11-01T07:17:14+00:00","first_seen_at":"2026-11-01T07:18:34+00:00","triaged_at":"2026-11-01T07:20:28+00:00","updated_at":"2026-11-01T07:20:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-01T07:20:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"loguru: crafted ANSI color markup causes regex slowdown in logging","impact":"low","summary":"Loguru 0.7.3's ANSI color-markup parser (AnsiParser.feed) uses a regular expression that becomes very slow on crafted input. A remote attacker can send messages that tie up CPU while the library parses them.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","loguru"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Denial of service by CPU exhaustion during log parsing","analyst_note":"Confirm the fixed loguru version and whether colorized markup parsing is on by default, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120217.","how_to_check":"- Check the installed loguru version with `pip show loguru` or `python -c \"import loguru; print(loguru.__version__)\"`.\n- Check whether the application passes untrusted input into logger calls that use color markup.","plain_action":"","needs_analyst":true,"not_affected_if":["other-logging-library","no-untrusted-input-logged"],"who_is_affected":"Applications that use loguru 0.7.3 and log attacker-controlled text with color markup parsing enabled are the ones exposed. Services that only log trusted internal strings have less exposure. The sources do not say which loguru versions are fixed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000688,"input_tokens":4155,"output_tokens":546,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120217':13A,16A '-2026':12A,15A '0.7.3':21B,61C 'affect':63C 'ansi':3A,23B,76C 'ansiparser.feed':28B,68C 'attack':42B,91C 'becom':34B 'carri':96C 'caus':6A 'color':4A,25B,78C 'color-markup':24B,77C 'complex':89C 'compon':75C 'contact':111C 'cpu':49B 'craft':2A,38B 'cve':11A,14A 'delgan':59C 'detect':57C 'disclosur':115C 'earli':112C 'element':64C 'exploit':100C 'express':32B,88C 'file':71C 'function':67C 'ineffici':86C 'input':39B 'librari':52B 'log':10A 'loguru':1A,17B,20B,60C 'loguru/_colorizer.py':72C 'manipul':83C 'markup':5A,26B,79C 'may':105C 'messag':45B 'packag':18B 'pars':53B 'parser':27B,80C 'perform':81C 'possibl':93C 'public':103C 'python':19B 'regex':7A 'regular':31B,87C 'remot':41B,98C 'respond':119C 'result':84C 'send':44B 'slow':36B 'slowdown':8A 'tie':47B 'use':29B,107C 'vendor':109C 'vulner':55C 'way':122C","nicknames":[],"mitigations":[],"who_affected":"Applications that use loguru 0.7.3 and log attacker-controlled text with color markup parsing enabled are the ones exposed. Services that only log trusted internal strings have less exposure. The sources do not say which loguru versions are fixed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-11-01T07:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120217","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120217","severity":null,"published_at":"2026-11-01T07:17:14+00:00","modified_at":"2026-11-01T07:17:14+00:00","first_seen_at":"2026-11-01T07:18:34+00:00","fetched_at":"2026-11-01T07:18:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}