PT-2023-9395 · Configobj+5 · Configobj+5

Darktinia · CVE-2023-26112 · Published 2023-04-03 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions configobj versions all versions

Description The issue is related to the use of a regular expression with inefficient computational complexity in the configobj package. This can be exploited to cause a denial of service. The validate function is vulnerable to Regular Expression Denial of Service (ReDoS) via the use of (.+?)((.*)). This is only exploitable in the case of a developer putting the offending value in a server-side configuration file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

BDU:2024-07015

CVE-2023-26112

GHSA-C33W-24P9-8M24

OPENSUSE-SU-2023_3369-1

OPENSUSE-SU-2024:13199-1

PYSEC-2026-1270

SUSE-SU-2023:3368-1

SUSE-SU-2023:3369-1

SUSE-SU-2023_3368-1

SUSE-SU-2023_3369-1

USN-7040-1

USN-7040-2

Affected Products

Debian

Linuxmint

Red Os

Suse

Ubuntu

Configobj

References · 39

• 🔥 https://security.snyk.io/vuln/SNYK-PYTHON-CONFIGOBJ-3252494 · Exploit
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/NZHY7B33EFY4LESP2NI4APQUPRROTAZK · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-26112 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26112 · Security Note
• https://osv.dev/vulnerability/CVE-2023-26112 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-26112 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-26112 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-1202SE17 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7040-2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PYU4IHVLOTYMFPH7KDOJGKZQR4GKWPFK · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/6BO4RLMYEJODCNUE3DJIIUUFVTPAG6VN · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:3368-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7040-2 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-1113SE18 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-1270 · Vendor Advisory