---
id: "CVE-2026-120217"
kind: "vulnerability"
aliases: ["CVE-2026-120217"]
title: "loguru: crafted ANSI color markup causes regex slowdown in logging"
severity: "medium"
cvss: 4.3
epss: 0.00271
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["loguru", "package", "python"]
not_affected_if: ["no-untrusted-input-logged", "other-logging-library"]
published_at: "2026-11-01T07:17:14+00:00"
first_seen_at: "2026-11-01T07:18:34+00:00"
updated_at: "2026-11-01T16:46:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120217", "first_seen_at": "2026-11-01T07:18:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-120217", "first_seen_at": "2026-11-01T16:46:41+00:00"}]
---

# loguru: crafted ANSI color markup causes regex slowdown in logging

Loguru 0.7.3's ANSI color-markup parser (AnsiParser.feed) uses a regular expression that becomes very slow on crafted input. A remote attacker can send messages that tie up CPU while the library parses them.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed loguru version with `pip show loguru` or `python -c "import loguru; print(loguru.__version__)"`.
- Check whether the application passes untrusted input into logger calls that use color markup.

## Timeline

- 2026-11-01T07:18:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120217
- 2026-11-01T16:46:41+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-120217

## From the sources

A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file loguru/_colorizer.py of the component ANSI Color-Markup Parser. Performing a manipulation results in inefficient regular expression complexity. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_