{"id":"CVE-2026-55520","aliases":["GHSA-wjmf-p669-5m5p","PYSEC-2026-3906"],"title":"Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching","summary":"Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching","severity":"high","vendor":"protego","product":"protego","ecosystem":"pip","affected":["protego < 0.6.2"],"patched":["protego 0.6.2"],"published":"2026-08-28","updated":"2026-09-10","sourceUpdated":"2026-09-10T12:25:43.026818158Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-wjmf-p669-5m5p","references":[{"url":"https://github.com/scrapy/protego/security/advisories/GHSA-wjmf-p669-5m5p"},{"url":"https://github.com/scrapy/protego/commit/785940181659bf440ba82f1da148fade5087e858"},{"url":"https://github.com/scrapy/protego"},{"url":"https://github.com/scrapy/protego/releases/tag/0.6.2"},{"url":"https://pypi.org/project/protego"},{"url":"https://github.com/advisories/GHSA-wjmf-p669-5m5p"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55520"}],"tags":["osv","pip","nvd","ghsa"],"epss":0.00511,"epssPercentile":0.41062,"cwe":["CWE-400","CWE-1333"],"ingestedAt":"2026-08-28T19:24:19.191Z","slug":"CVE-2026-55520","body":"## Overview\n\n### Problem description\n\nProtego constructs regular expressions to match URLs against `robots.txt` `Allow:` and `Disallow:` directives, see `protego._urlpattern._URLPattern._prepare_pattern_for_regex()`. Every `*` in the directive value is translated into a lazy `.*?` regex piece, thus a specially crafted directive value with many asterisks may produce a regex that freezes the parser due to exponential backtracking.\n\n### Impact\n\nParsing a specially crafted `robots.txt` with `protego.Protego.parse()` and then trying to match an URL with `protego.Protego.can_fetch()` results in the latter call not returning for a period dependent on the length of the URL.\n\n### Proof of concept\n\n```python\nfrom protego import Protego\n\nrobotstxt = f\"\"\"\nUser-agent: *\nDisallow: /{\"*1\" * 12}*Z\n\"\"\"\nrp = Protego.parse(robotstxt)\nurl = \"/\" + \"1\" * 60\nrp.can_fetch(url, \"mybot\")  # freezes\n```\n\n## Affected packages\n\n- `protego < 0.6.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `protego 0.6.2`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}