{"id":"CVE-2026-55520","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-55520","summary":"Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching","details":"### Problem description\n\nProtego constructs regular expressions to match URLs against `robots.txt` `Allow:` and `Disallow:` directives, see `protego._urlpattern._URLPattern._prepare_pattern_for_regex()`. Every `*` in the directive value is translated into a lazy `.*?` regex piece, thus a specially crafted directive value with many asterisks may produce a regex that freezes the parser due to exponential backtracking.\n\n### Impact\n\nParsing a specially crafted `robots.txt` with `protego.Protego.parse()` and then trying to match an URL with `protego.Protego.can_fetch()` results in the latter call not returning for a period dependent on the length of the URL.\n\n### Proof of concept\n\n```python\nfrom protego import Protego\n\nrobotstxt = f\"\"\"\nUser-agent: *\nDisallow: /{\"*1\" * 12}*Z\n\"\"\"\nrp = Protego.parse(robotstxt)\nurl = \"/\" + \"1\" * 60\nrp.can_fetch(url, \"mybot\")  # freezes\n```","published":"2026-08-28T18:43:02Z","modified":"2026-08-28T18:45:07.833305860Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"protego","fixedVersion":"0.6.2"}],"fix":{"url":"https://github.com/scrapy/protego/commit/785940181659bf440ba82f1da148fade5087e858","label":"scrapy/protego@7859401"},"references":[{"type":"WEB","url":"https://github.com/scrapy/protego/security/advisories/GHSA-wjmf-p669-5m5p"},{"type":"WEB","url":"https://github.com/scrapy/protego/commit/785940181659bf440ba82f1da148fade5087e858"},{"type":"PACKAGE","url":"https://github.com/scrapy/protego"},{"type":"WEB","url":"https://github.com/scrapy/protego/releases/tag/0.6.2"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-28T18:45:07.833305860Z"}}