cve.bz

CVE-2023-26112

5.9 mediumEPSS 1.3%

Medium (5.9) in configobj project configobj. EPSS 1.3% chance of exploitation in the next 30 days. Fixed in configobj 5.0.9.

All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). **Note:** This is only exploitable in the case of a developer, putting the offending value in a server side configuration file.

Severity

CVSS 3.1

5.9 medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
1.3% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
CWE
CWE-1333
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-c33w-24p9-8m24PyPIconfigobj<5.0.95.0.9
PYSEC-2026-1270PyPIconfigobj<5.0.95.0.9

References

Check your stackJSON