https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 23:47:30 +0000 https://db.gcve.eu/vuln/certfr-2026-avi-1233 certfr-2026-avi-1233 https://db.gcve.eu/vuln/certfr-2026-avi-1233 https://db.gcve.eu/vuln/fkie_cve-2026-85062 <p>Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and src/colorModels/cmykString.ts use the ambiguous numeric regular expression ([+-]?\d*.?\d+), allowing the same digits to be divided between overlapping quantifiers in quadratically many ways when malformed input is rejected. An attacker who can supply an unbounded color string to colord(), getFormat(), isEqual(), mix(), or contrast(), including through a request body, JSON field, or uploaded stylesheet, can block the processing thread with a multi-kilobyte payload. The affected matchers are parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. This issue is fixed in version 2.9.4.</p> <p>Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and src/colorModels/cmykString.ts use the ambiguous numeric regular expression ([+-]?\d*.?\d+), allowing the same digits to be divided between overlapping quantifiers in quadratically many ways when malformed input is rejected. An attacker who can supply an unbounded color string to colord(), getFormat(), isEqual(), mix(), or contrast(), including through a request body, JSON field, or uploaded stylesheet, can block the processing thread with a multi-kilobyte payload. The affected matchers are parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. This issue is fixed in version 2.9.4.</p> https://db.gcve.eu/vuln/fkie_cve-2026-85062 https://db.gcve.eu/vuln/ghsa-2wm5-q62r-hmrv <p><strong>Affected:</strong> npm: colord</p> <p>### Impact</p> <p>`colord`&#39;s CSS color string matchers described a number as `([+-]?\d*\.?\d+)`. In that form `\d*` and `\d+` can match the same digits, so a run of *n* digits can be divided between them in O(n²) ways, and rejecting an input retries every division. Parsing is synchronous and uninterruptible, so a long malformed color string blocks the thread:</p> <p>| input | time to reject | | --- | --- | | 16 KB | 224 ms | | 64 KB | 4.4 s | | 128 KB | 18.5 s |</p> <p>Reachable through `colord()` and `getFormat()`, and through any method that accepts a color string — including `isEqual()`, `mix()` and `contrast()`. The affected matchers are `parseRgbaString` and `parseHslaString` (built in) and `parseHwbaString`, `parseLchaString`, `parseCmykaString` (plugins).</p> <p>Growth is polynomial, not exponential — multi-kilobyte payloads are required for a noticeable stall.</p> <p>### Who is affected</p> <p>Applications that pass attacker-controlled strings of unbounded length to `colord()` — for example a server validating a color taken from a request body, JSON field, or uploaded stylesheet. `colord` applies no length limit before matching.</p> <p>Typical client-side use with short input is not meaningfully affected.</p> <p>### Patches</p> <p>Fixed in **2.9.4**. The number is now written as `([+-]?(?:\d*\.\d+|\d+))`, which accepts exactly the same syntax but leaves only one way to match it, making rejection linear — 1 MB of input is rejected in ~5 ms.</p> <p>### Workarounds</p> <p>Reject or truncate color strings longer than a sane limit (e.g.…</p> <p><strong>Affected:</strong> npm: colord</p> <p>### Impact</p> <p>`colord`&#39;s CSS color string matchers described a number as `([+-]?\d*\.?\d+)`. In that form `\d*` and `\d+` can match the same digits, so a run of *n* digits can be divided between them in O(n²) ways, and rejecting an input retries every division. Parsing is synchronous and uninterruptible, so a long malformed color string blocks the thread:</p> <p>| input | time to reject | | --- | --- | | 16 KB | 224 ms | | 64 KB | 4.4 s | | 128 KB | 18.5 s |</p> <p>Reachable through `colord()` and `getFormat()`, and through any method that accepts a color string — including `isEqual()`, `mix()` and `contrast()`. The affected matchers are `parseRgbaString` and `parseHslaString` (built in) and `parseHwbaString`, `parseLchaString`, `parseCmykaString` (plugins).</p> <p>Growth is polynomial, not exponential — multi-kilobyte payloads are required for a noticeable stall.</p> <p>### Who is affected</p> <p>Applications that pass attacker-controlled strings of unbounded length to `colord()` — for example a server validating a color taken from a request body, JSON field, or uploaded stylesheet. `colord` applies no length limit before matching.</p> <p>Typical client-side use with short input is not meaningfully affected.</p> <p>### Patches</p> <p>Fixed in **2.9.4**. The number is now written as `([+-]?(?:\d*\.\d+|\d+))`, which accepts exactly the same syntax but leaves only one way to match it, making rejection linear — 1 MB of input is rejected in ~5 ms.</p> <p>### Workarounds</p> <p>Reject or truncate color strings longer than a sane limit (e.g.…</p> https://db.gcve.eu/vuln/ghsa-2wm5-q62r-hmrv https://db.gcve.eu/vuln/msrc_cve-2026-85062 msrc_CVE-2026-85062 https://db.gcve.eu/vuln/msrc_cve-2026-85062