Inefficient regex in loguru ANSI color markup parser
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Deferred Red Hat: fix deferred
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-1333.
Summary
Delgan loguru from 0.7.3 contains an inefficient regular expression in the AnsiParser.feed function of its ANSI color markup parser. Crafted input makes the regex consume excessive processing time, a flaw classified as CWE-1333. A remote attacker with low privileges can trigger it, which affects availability. A public exploit exists, and the vendor did not respond to early disclosure contact.
Written with Claude Haiku 5.5 from the sources below · 2026-11-01
Description from the CNA
A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file loguru/_colorizer.py of the component ANSI Color-Markup Parser. Performing a manipulation results in inefficient regular expression complexity. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for Delgan loguru. Red Hat lists Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3 and Red Hat OpenShift AI (RHOAI) as affected, with no fix available.
Written with Claude Haiku 5.5 from the sources below · 2026-11-01
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat AI Inference Server | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
Timeline
- 2026-11-01 Threatist record created from CVE-2026-120217
- 2026-11-01 Alias added: GHSA-h6r7-8xvv-hr33
- 2026-11-01 Affected versions changed · Red Hat
- 2026-11-01 CVSS score added · Red Hat
- 2026-11-05 CISA SSVC decision points changed
References
—
Sources
- CVE-2026-120217 · CVE Program
- CVE-2026-120217 · NVD
- FIRST EPSS
- GHSA-h6r7-8xvv-hr33 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-120217 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences