CVE-2026-112300: DiffSK configobj __init__.py _sectionmarker redos
A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function sectionmarker of the file configobj/init.py. The manipulation leads to inefficient regular expression complexity. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which versions are affected?
DiffSK configobj versions up to 5.0.9 are reported as affected. The available information does not identify a fixed version.
Can this be exploited remotely without authentication or user interaction?
Yes. The reported CVSS vector indicates network reachability, low attack complexity, no privileges required, and no user interaction required.
What is the likely security impact?
The issue is an inefficient regular expression complexity problem in _sectionmarker in configobj/__init__.py. The reported impact is limited to availability, consistent with potential resource consumption or denial of service; no confidentiality or integrity impact is reported.
Is a vendor response or patch available?
The project was reportedly notified early through an issue report but had not responded at the time of the report. No patch or mitigation is identified in the available information.