Description
A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file loguru/_colorizer.py of the component ANSI Color-Markup Parser. Performing a manipulation results in inefficient regular expression complexity. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-11-01
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

Delgan loguru 0.7.3 contains a regular expression that is susceptible to exponential back‑tracking when processing the AnsiParser.feed function in the ANSI Color‑Markup Parser. The complexity of the parsing routine can be manipulated to consume excessive CPU resources, resulting in a denial‑of‑service condition for the process that performs the parsing. The description explicitly states that the exploit is now public and can be carried out remotely, indicating that an attacker need not have local access to trigger the failure.

Affected Systems

The affected vendor is Delgan, product Loguru. The version explicitly listed as affected is 0.7.3. No other versions are mentioned in the provided data.

Risk and Exploitability

The CVSS score of 5.3 places this vulnerability in the medium severity range, while the EPSS score is not available, and it is not listed in the CISA KEV catalog. Because the attack can be performed remotely and the exploit is publicly available, the risk that an active adversary will leverage this weakness remains significant. An attacker would supply a specially crafted input string to AnsiParser.feed, causing the regular expression engine to enter a state of exponential back‑tracking, exhausting CPU resources and potentially crashing the application or processing thread.

Generated by OpenCVE AI on November 1, 2026 at 07:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Loguru to the latest patched release (if available)
  • If an update is not immediately possible, configure the application to reject or sanitize any ANSI‑style markup strings before passing them to AnsiParser.feed
  • Implement resource usage limits or watchdogs to detect and recover from excessive CPU consumption

Generated by OpenCVE AI on November 1, 2026 at 07:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 01 Nov 2026 06:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file loguru/_colorizer.py of the component ANSI Color-Markup Parser. Performing a manipulation results in inefficient regular expression complexity. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Delgan loguru ANSI Color-Markup _colorizer.py AnsiParser.feed redos
First Time appeared Delgan
Delgan loguru
Weaknesses CWE-1333
CWE-400
CPEs cpe:2.3:a:delgan:loguru:*:*:*:*:*:*:*:*
Vendors & Products Delgan
Delgan loguru
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}


cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-01T06:15:17.369Z

Reserved: 2026-10-31T16:29:58.549Z

Link: CVE-2026-120217

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-01T07:17:14.487

Modified: 2026-11-01T07:17:14.487

Link: CVE-2026-120217

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-01T07:30:03Z

Weaknesses
  • CWE-1333

    Inefficient Regular Expression Complexity

  • CWE-400

    Uncontrolled Resource Consumption