---
id: CVE-2026-55520
aliases:
  - GHSA-wjmf-p669-5m5p
  - PYSEC-2026-3906
title: Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching
summary: Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching
severity: high
vendor: protego
product: protego
ecosystem: pip
affected:
  - protego < 0.6.2
patched:
  - protego 0.6.2
published: '2026-08-28'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T12:25:43.026818158Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-wjmf-p669-5m5p'
references:
  - url: 'https://github.com/scrapy/protego/security/advisories/GHSA-wjmf-p669-5m5p'
  - url: >-
      https://github.com/scrapy/protego/commit/785940181659bf440ba82f1da148fade5087e858
  - url: 'https://github.com/scrapy/protego'
  - url: 'https://github.com/scrapy/protego/releases/tag/0.6.2'
  - url: 'https://pypi.org/project/protego'
  - url: 'https://github.com/advisories/GHSA-wjmf-p669-5m5p'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55520'
tags:
  - osv
  - pip
  - nvd
  - ghsa
epss: 0.00511
epssPercentile: 0.41062
cwe:
  - CWE-400
  - CWE-1333
ingestedAt: '2026-08-28T19:24:19.191Z'
---

## Overview

### Problem description

Protego constructs regular expressions to match URLs against `robots.txt` `Allow:` and `Disallow:` directives, see `protego._urlpattern._URLPattern._prepare_pattern_for_regex()`. Every `*` in the directive value is translated into a lazy `.*?` regex piece, thus a specially crafted directive value with many asterisks may produce a regex that freezes the parser due to exponential backtracking.

### Impact

Parsing a specially crafted `robots.txt` with `protego.Protego.parse()` and then trying to match an URL with `protego.Protego.can_fetch()` results in the latter call not returning for a period dependent on the length of the URL.

### Proof of concept

```python
from protego import Protego

robotstxt = f"""
User-agent: *
Disallow: /{"*1" * 12}*Z
"""
rp = Protego.parse(robotstxt)
url = "/" + "1" * 60
rp.can_fetch(url, "mybot")  # freezes
```

## Affected packages

- `protego < 0.6.2`

## Remediation

Upgrade to a patched release:

- `protego 0.6.2`