Description
All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\).
**Note:** This is only exploitable in the case of a developer, putting the offending value in a server side configuration file.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | configobj | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | configobj | 5.0.8-2 | — |
| Debian 13 | configobj | 5.0.8-2 | — |
| Debian 12 | configobj | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | configobj | 5.0.6-5ubuntu0.1 | USN-7040-1 |
| Ubuntu 20.04 LTS | configobj | 5.0.6-4ubuntu0.1 | USN-7040-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | configobj | 5.0.6-2ubuntu0.18.04.1~esm1 | USN-7040-1 |
| Ubuntu Pro 16.04 LTS | configobj | 5.0.6-2ubuntu0.16.04.1~esm1 | USN-7040-1 |
| Ubuntu Pro 14.04 LTS | configobj | 4.7.2+ds-5ubuntu0.1~esm1 | USN-7040-2 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | python-configobj | 5.0.6-150000.3.3.1 | SUSE-SU-2023:3369-1 |
| SLES 15 SP4 | python-configobj | 5.0.6-150000.3.3.1 | SUSE-SU-2023:3369-1 |
| SLES 12 SP5 | python-configobj | 5.0.6-20.8.1 | SUSE-SU-2023:3368-1 |
| SLES 12 | python-configobj | 5.0.6-20.8.1 | SUSE-SU-2023:3368-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | python-configobj | 5.0.6-20.8.1 | SUSE-SU-2023:3368-1 |
| SLE Real Time 15 SP3 | python-configobj | 5.0.6-150000.3.3.1 | SUSE-SU-2023:3369-1 |
| SLE Micro 5.4 | python-configobj | 5.0.6-150000.3.3.1 | SUSE-SU-2023:3369-1 |
| SUSE Manager Server 4.2 | python-configobj | 5.0.6-150000.3.3.1 | SUSE-SU-2023:3369-1 |
| SUSE Manager Proxy 4.2 | python-configobj | 5.0.6-150000.3.3.1 | SUSE-SU-2023:3369-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-configobj | 5.0.9-1.6 | openSUSE-SU-2026:12005-1 |
| openSUSE Leap 15.5 | python-configobj | 5.0.6-150000.3.3.1 | SUSE-SU-2023:3369-1 |
| openSUSE Leap 15.4 | python-configobj | 5.0.6-150000.3.3.1 | SUSE-SU-2023:3369-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.4 | python-configobj | 5.0.6-150000.3.3.1 | SUSE-SU-2023:3369-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3-configobj | 5.0.6-23.amzn2023.0.3 | ALAS2023-2023-254 |
| Amazon Linux 2 | python-configobj | 4.7.2-7.amzn2.0.1 | ALAS2-2023-2188 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | py3.14-configobj | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | configobj | < 5.0.9 | 5.0.9 | GHSA-c33w-24p9-8m24 |
Advisories 7
- openSUSE-SU-2026:12005-1 python313-configobj-5.0.9-1.6 on GA media SUSE / openSUSE Security Updates · Oct 5, 2026
- USN-7040-2 configobj vulnerability Ubuntu Security Notices (USN) · Jun 29, 2026
- USN-7040-1 configobj vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- SUSE-SU-2023:3368-1 Security update for python-configobj SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:3369-1 Security update for python-configobj SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2-2023-2188 Low: python-configobj security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 8, 2023
- ALAS2023-2023-254 Low: python-configobj security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 20, 2023
References
- https://security.snyk.io/vuln/SNYK-PYTHON-CONFIGOBJ-3252494
- https://github.com/DiffSK/configobj/issues/232
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZHY7B33EFY4LESP2NI4APQUPRROTAZK/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BO4RLMYEJODCNUE3DJIIUUFVTPAG6VN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYU4IHVLOTYMFPH7KDOJGKZQR4GKWPFK/