CVE-2026-85062: Colord: Slow rejection of oversized malformed color strings
Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and src/colorModels/cmykString.ts use the ambiguous numeric regular expression ([+-]?\d.?\d+), allowing the same digits to be divided between overlapping quantifiers in quadratically many ways when malformed input is rejected. An attacker who can supply an unbounded color string to colord(), getFormat(), isEqual(), mix(), or contrast(), including through a request body, JSON field, or uploaded stylesheet, can block the processing thread with a multi-kilobyte payload. The affected matchers are parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. This issue is fixed in version 2.9.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
colordto a version that resolves this vulnerability.Fixed in 2.9.4
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using colord before 2.9.4 are exposed when untrusted parties can provide unbounded color strings to colord(), getFormat(), isEqual(), mix(), or contrast(). Relevant input paths include request bodies, JSON fields, and uploaded stylesheets.
What does an attacker need to do to exploit it?
An attacker needs to submit a multi-kilobyte malformed color string to one of the affected synchronous parsing paths. The ambiguous numeric regular expression can take quadratically longer to reject that input, blocking the processing thread.
Which color formats are affected?
The affected parsers are parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. They correspond to RGB(A), HSL(A), HWB(A), LCH(A), and CMYK(A) color-string matching.
What should be done if patching is not immediately possible?
Prevent unbounded untrusted color strings from reaching the listed colord APIs. Enforce input length limits for relevant request fields, JSON values, and uploaded stylesheet content.