Read the docs
TI-2026-40066 Aliases CVE-2026-55520GHSA-wjmf-p669-5m5p

Protego: Exponential backtracking ReDoS in robots.txt URL wildcard matching

Priority LOW 38CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1333.

Summary

Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego._urlpattern._URLPattern._prepare_pattern_for_regex translates every asterisk in an Allow or Disallow directive into a lazy regular-expression wildcard, so a directive containing many asterisks creates exponential backtracking. After protego.Protego.parse processes a crafted robots.txt file, protego.Protego.can_fetch can spend an attacker-controlled period matching a near-miss URL and deny service to the crawler. The vulnerable path is src/protego/_urlpattern.py in the _URLPattern match logic. This issue is fixed in version 0.6.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00511 43rd percentileScored 2026-11-07
Fix Fixed protego (scrapy): 0.6.2Protego (PyPI): 0.6.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
scrapyprotegobefore 0.6.20.6.2Patch availableCNA
—Protego (PyPI)before 0.6.20.6.2Patch availableGHSA-wjmf-p669-5m5p
  • protego Vendorscrapy Affected before 0.6.2 Fixed in 0.6.2 Patch available CNA
  • Protego (PyPI) Vendor— Affected before 0.6.2 Fixed in 0.6.2 Patch available GHSA-wjmf-p669-5m5p

Remediation

  • Fix · CNA protego (scrapy) Fixed in 0.6.2
  • Fix · GHSA-wjmf-p669-5m5p Protego (PyPI) Fixed in 0.6.2 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55520
  2. 2026-10-03 Alias added: GHSA-wjmf-p669-5m5p

References

Other 4

  • TI-2025-05586 Brotli decompression bomb DoS in scrapy/scrapy CVSS 3.0HIGH 7.5
  • TI-2024-03333 Authorization Header Leak During Cross-Domain Redirect in scrapy/scrapy CVSS 3.0HIGH 7.5
  • TI-2024-03331 XML External Entity (XXE) Vulnerability in scrapy/scrapy CVSS 3.0HIGH 7.5
  • TI-2024-01831 Authorization Header Leakage in scrapy/scrapy on Scheme Change Redirects CVSS 3.0HIGH 7.5
  • TI-2026-68383 Arbitrary module import via Referrer-Policy header in Scrapy CVSS 3.1HIGH 7.5
  • TI-2017-10313 Scrapy 1.4 allows remote attackers to cause a denial of service (memory consumption) via… CVSS 3.0HIGH 7.5
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences