In Pylons Colander through 1.6, the URL validator allows an attacker to potentially cause an infinite loop thereby causing a denial of service via an unclosed parenthesis.
CVSS 3.0HIGH 7.5·Network·No auth·No interaction·EPSS 0.02072·Published 2019-02-01·Fixed in 1.7.0CWE-835