Log in Start free

Vulnerability · Published Oct 19, 2026 · Assigned by VulDB

CVE-2026-112300DiffSK configobj __init__.py _sectionmarker redos

Medium 5.3

In plain English

A medium-severity regular-expression denial of service in configobj from DiffSK. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.5%top 54.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function _sectionmarker of the file configobj/__init__.py. The manipulation leads to inefficient regular expression complexity. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12configobjno fix listedDEBIAN-CVE-2026-112300
Debian:13configobjno fix listedDEBIAN-CVE-2026-112300
Debian:14configobjno fix listedDEBIAN-CVE-2026-112300
Ubuntu:22.04:LTSconfigobjno fix listedUBUNTU-CVE-2026-112300
Ubuntu:24.04:LTSconfigobjno fix listedUBUNTU-CVE-2026-112300
Ubuntu:26.04:LTSconfigobjno fix listedUBUNTU-CVE-2026-112300
Ubuntu:26.10configobjno fix listedUBUNTU-CVE-2026-112300

Affected products (as reported)

VendorProductVersions
DiffSK configobj 5.0.05.0.15.0.25.0.35.0.45.0.55.0.65.0.7

Weakness: CWE-1333, CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C

References