Regular expression denial of service in configobj
Priority MEDIUM 60CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). **Note:** This is only exploitable in the case of a developer, putting the offending value in a server side configuration file.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01269 69th percentileScored 2026-11-07
Fix Partial configobj (PyPI): 5.0.9Red Hat: 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | configobj | all versions | — | No fix listed | CNA |
| — | configobj (PyPI) | before 5.0.9 | 5.0.9 | Patch available | GHSA-c33w-24p9-8m24 |
- configobj Vendor— Affected all versions Fixed in — No fix listed CNA
- configobj (PyPI) Vendor— Affected before 5.0.9 Fixed in 5.0.9 Patch available GHSA-c33w-24p9-8m24
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:configobj_project:configobj:*:*:*:*:*:*:*:* | all versions | Vulnerable | Configobj Project |
- cpe:2.3:a:configobj_project:configobj:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Configobj Project
Remediation
- Fix · GHSA-c33w-24p9-8m24 configobj (PyPI) Fixed in 5.0.9 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Dev Spaces | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2023-26112
- 2026-10-03 Alias added: GHSA-c33w-24p9-8m24
References
Other 10
- https://github.com/DiffSK/configobj/issues/232
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NZHY7B33EFY4LESP2NI4APQUPRROTAZK/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/6BO4RLMYEJODCNUE3DJIIUUFVTPAG6VN/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PYU4IHVLOTYMFPH7KDOJGKZQR4GKWPFK/
- https://github.com/DiffSK/configobj/commit/7c618b0bbaff6ecaca51a6f05b29795d1377a4a5
- https://github.com/DiffSK/configobj
- https://lists.fedoraproject.org/archives/list/[email protected]/message/6BO4RLMYEJODCNUE3DJIIUUFVTPAG6VN
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NZHY7B33EFY4LESP2NI4APQUPRROTAZK
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PYU4IHVLOTYMFPH7KDOJGKZQR4GKWPFK
- https://pypi.org/project/configobj/5.0.9
Sources
- CVE-2023-26112 · CVE Program
- CVE-2023-26112 · NVD
- FIRST EPSS
- GHSA-c33w-24p9-8m24 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-26112 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences