Colord contains a parsing weakness that matches malformed numeric patterns with an ambiguous regular expression, classified as CWE-1333. When an attacker supplies an oversized malformed color string to functions such as colord(), getFormat(), isEqual(), mix(), or contrast(), the regex engine explores a number of match combinations that grows quadratically with the input size. This causes the target thread to block for a prolonged period, effectively denying service to legitimate users. The weakness is an input parsing flaw that can be triggered by any user‑supplied data handled by the library.

The issue affects all releases of the omgovich colord tool older than version 2.9.4. The vulnerable parsers reside in src/colorModels/rgbString.ts, hslString.ts, hwbString.ts, lchString.ts, and cmykString.ts, and the problem is present in the exported functions parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. Applications that embed colord and invoke any of the public API functions with untrusted input—including request bodies, JSON fields, or uploaded stylesheets—are at risk.

The CVSS score of 6.9 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is not available, so no quantitative exploitation likelihood is provided. The attack vector is likely local or remote via any service that accepts color strings from external requests, such as web servers that parse stylesheets or JSON payloads. An attacker who can submit a multi‑kilobyte malformed color string can force the processing thread to hang, resulting in a denial of service. The exploit requires no special privileges, making it feasible for a broad threat set.