CVE-2026-55520

Received Received - Intake

ReDoS in Protego robots.txt Parser via Exponential Backtracking

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego._urlpattern._URLPattern._prepare_pattern_for_regex translates every asterisk in an Allow or Disallow directive into a lazy regular-expression wildcard, so a directive containing many asterisks creates exponential backtracking. After protego.Protego.parse processes a crafted robots.txt file, protego.Protego.can_fetch can spend an attacker-controlled period matching a near-miss URL and deny service to the crawler. The vulnerable path is src/protego/_urlpattern.py in the _URLPattern match logic. This issue is fixed in version 0.6.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55520

EUVD

EUVD-2026-67865

Affected Vendors & Products

Vendor	Product	Version / Range
protego	protego	0.6.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This is a ReDoS (Regular Expression Denial of Service) vulnerability in the Protego library. It occurs when URL patterns from robots.txt Allow or Disallow directives are converted into regular expressions. Multiple asterisks (*) in these directives cause exponential backtracking during regex matching, leading to excessive CPU usage and system hangs.

Detection Guidance

Check if Protego is installed and its version. Run: pip show protego. If version is 0.6.1 or earlier, the system is vulnerable. Monitor for high CPU usage during URL matching operations, especially when processing robots.txt files with excessive asterisks.

Impact Analysis

An attacker could exploit this by serving a crafted robots.txt file with many asterisks in directives. When Protego processes this file and checks URL access, the system may freeze or consume excessive CPU resources, denying service to legitimate crawlers or applications using the library.

Mitigation Strategies

Upgrade Protego to version 0.6.2 or later immediately. Update dependencies in your project to enforce this version. If upgrading is not possible, disable robots.txt parsing or implement strict input validation for robots.txt files to prevent malicious patterns.

Hi! I’m here to help you understand CVE-2026-55520. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70