Low severity3.7NVD Advisory· Published Apr 3, 2023· Updated Jun 17, 2026
CVE-2023-26112
CVE-2023-26112
Description
All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). Note: This is only exploitable in the case of a developer, putting the offending value in a server side configuration file.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
configobjPyPI | < 5.0.9 | 5.0.9 |
Affected products
27- cpe:2.3:a:configobj_project:configobj:*:*:*:*:*:*:*:*
- configobj/configobjdescription
- osv-coords25 versionspkg:apk/chainguard/py3-configobjpkg:apk/chainguard/py3-supported-configobjpkg:apk/chainguard/py3.10-configobjpkg:apk/chainguard/py3.11-configobjpkg:apk/chainguard/py3.12-configobjpkg:apk/chainguard/py3.13-configobjpkg:apk/wolfi/py3-configobjpkg:apk/wolfi/py3-supported-configobjpkg:apk/wolfi/py3.10-configobjpkg:apk/wolfi/py3.11-configobjpkg:apk/wolfi/py3.12-configobjpkg:apk/wolfi/py3.13-configobjpkg:pypi/configobjpkg:rpm/opensuse/python-configobj&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/python-configobj&distro=openSUSE%20Leap%2015.5pkg:rpm/opensuse/python-configobj&distro=openSUSE%20Leap%20Micro%205.4pkg:rpm/suse/python-configobj&distro=SUSE%20Linux%20Enterprise%20Micro%205.4pkg:rpm/suse/python-configobj&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP4pkg:rpm/suse/python-configobj&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP5pkg:rpm/suse/python-configobj&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Public%20Cloud%2012pkg:rpm/suse/python-configobj&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP3pkg:rpm/suse/python-configobj&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/python-configobj&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/python-configobj&distro=SUSE%20Manager%20Proxy%204.2pkg:rpm/suse/python-configobj&distro=SUSE%20Manager%20Server%204.2
< 0+ 24 more
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 0
- (no CPE)range: < 5.0.9
- (no CPE)range: < 5.0.6-150000.3.3.1
- (no CPE)range: < 5.0.6-150000.3.3.1
- (no CPE)range: < 5.0.6-150000.3.3.1
- (no CPE)range: < 5.0.6-150000.3.3.1
- (no CPE)range: < 5.0.6-150000.3.3.1
- (no CPE)range: < 5.0.6-150000.3.3.1
- (no CPE)range: < 5.0.6-20.8.1
- (no CPE)range: < 5.0.6-150000.3.3.1
- (no CPE)range: < 5.0.6-20.8.1
- (no CPE)range: < 5.0.6-20.8.1
- (no CPE)range: < 5.0.6-150000.3.3.1
- (no CPE)range: < 5.0.6-150000.3.3.1
Patches
Vulnerability mechanics
References
12- security.snyk.io/vuln/SNYK-PYTHON-CONFIGOBJ-3252494nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-c33w-24p9-8m24ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-26112ghsaADVISORY
- github.com/DiffSK/configobj/commit/7c618b0bbaff6ecaca51a6f05b29795d1377a4a5ghsaWEB
- github.com/DiffSK/configobj/issues/232nvdIssue TrackingWEB
- lists.fedoraproject.org/archives/list/[email protected]/message/6BO4RLMYEJODCNUE3DJIIUUFVTPAG6VNghsaWEB
- lists.fedoraproject.org/archives/list/[email protected]/message/NZHY7B33EFY4LESP2NI4APQUPRROTAZKghsaWEB
- lists.fedoraproject.org/archives/list/[email protected]/message/PYU4IHVLOTYMFPH7KDOJGKZQR4GKWPFKghsaWEB
- pypi.org/project/configobj/5.0.9ghsaWEB
- lists.fedoraproject.org/archives/list/[email protected]/message/6BO4RLMYEJODCNUE3DJIIUUFVTPAG6VN/nvd
- lists.fedoraproject.org/archives/list/[email protected]/message/NZHY7B33EFY4LESP2NI4APQUPRROTAZK/nvd
- lists.fedoraproject.org/archives/list/[email protected]/message/PYU4IHVLOTYMFPH7KDOJGKZQR4GKWPFK/nvd
News mentions
0No linked articles in our index yet.