This vulnerability is a regular expression denial of service (ReDoS) triggered in the _sectionmarker function of DiffSK configobj's __init__.py. By supplying specially crafted input that forces the regex to backtrack excessively, an attacker can cause the parsing routine to consume excessive CPU time, leading the application to slow down or crash. The weakness is reflected in CWE-1333 (Excessive Computation) and CWE-400 (Uncontrolled Resource Consumption). The result is a loss of availability for the affected service.

DiffSK configobj versions up to 5.0.9 are affected. Any installation that uses this library without upgrading beyond that release is vulnerable.

The CVSS score of 6.9 indicates moderate to high impact, and the description explicitly states that remote exploitation is possible by sending malformed configuration data. The EPSS score is not available, so the current exploitation probability is uncertain, but the lack of an EPSS entry does not diminish the potential risk. The vulnerability is not listed in CISA KEV. The likely attack vector involves an attacker transmitting an over-the-network configuration file that triggers the regex backtracking and forces the application to consume excessive resources.