CVE-2026-85062

Received Received - Intake

ReDoS Vulnerability in Colord Color Parsing

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: GitHub, Inc.

Description

Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and src/colorModels/cmykString.ts use the ambiguous numeric regular expression ([+-]?\d*.?\d+), allowing the same digits to be divided between overlapping quantifiers in quadratically many ways when malformed input is rejected. An attacker who can supply an unbounded color string to colord(), getFormat(), isEqual(), mix(), or contrast(), including through a request body, JSON field, or uploaded stylesheet, can block the processing thread with a multi-kilobyte payload. The affected matchers are parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. This issue is fixed in version 2.9.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-03

Last Modified

2026-09-03

Generated

2026-09-04

AI Q&A

2026-09-04

EPSS Evaluated

N/A

NVD

CVE-2026-85062

Affected Vendors & Products

Vendor	Product	Version / Range
colord	colord	to 2.9.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Colord library before version 2.9.4. It involves synchronous CSS color string matchers in multiple files that use an ambiguous numeric regular expression. This allows malformed input to be processed in many overlapping ways, causing a denial of service by blocking the processing thread with a large payload.

Detection Guidance

This vulnerability can be detected by checking the version of colord installed on your system. If the version is below 2.9.4, the system is vulnerable. Use the command 'colord --version' or check package managers like 'apt list --installed | grep colord' or 'yum list installed colord'.

Impact Analysis

An attacker could exploit this by providing a specially crafted color string to functions like colord(), getFormat(), isEqual(), mix(), or contrast(). This could lead to a denial of service, causing the application to hang or become unresponsive when processing such input.

Mitigation Strategies

Immediately update colord to version 2.9.4 or later. Use your package manager to upgrade, e.g., 'sudo apt update && sudo apt upgrade colord' for Debian-based systems or 'sudo yum update colord' for RHEL-based systems.

Hi! I’m here to help you understand CVE-2026-85062. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70