Inefficient Regular Expression Complexity in configobj

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description

A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function _sectionmarker of the file configobj/__init__.py. The manipulation leads to inefficient regular expression complexity. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-112300

Affected Vendors & Products

Vendor	Product	Version / Range
DiffSK	configobj	5.0.0
DiffSK	configobj	5.0.1
DiffSK	configobj	5.0.2
DiffSK	configobj	5.0.3
DiffSK	configobj	5.0.4
DiffSK	configobj	5.0.5
DiffSK	configobj	5.0.6
DiffSK	configobj	5.0.7
DiffSK	configobj	5.0.8
DiffSK	configobj	5.0.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability exists in DiffSK configobj versions up to 5.0.9. It affects the _sectionmarker function in configobj/__init__.py, causing inefficient regular expression complexity. The issue allows remote attackers to exploit it, though the project has not responded to the reported problem yet.

Impact Analysis

The vulnerability could lead to denial-of-service conditions due to excessive resource consumption from inefficient regular expressions. Attackers might exploit it to slow down or crash systems using affected versions of configobj.

Mitigation Strategies

Update DiffSK configobj to the latest version beyond 5.0.9 to address the inefficient regular expression complexity in the _sectionmarker function. If no update is available, consider removing or replacing the affected component until a patch is released.

Hi! I’m here to help you understand CVE-2026-112300. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70