Delgan Loguru 0.7.3 ANSI Color-Markup Parser Regular Expression Denial of Service (ReDoS) Vulnerability (CVE-2026-120217)
Executive & SecOps Summary
SECOPS ASSESSMENTDelgan Loguru library version 0.7.3 and prior
Remote attackers can exploit inefficient regular expression complexity to trigger a Regular Expression Denial of Service (ReDoS), causing high CPU utilization and application unresponsiveness
Upgrade to a non-vulnerable version of Loguru, or sanitize and restrict the length of untrusted inputs before passing them to the logger
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade your Loguru dependency to the latest secure version using your package manager of choice (pip or poetry).
# Upgrade Loguru using pip
pip install --upgrade loguru
# If using poetry, update the dependency
poetry add loguru@latest2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, implement an input validation layer to sanitize and strip ANSI escape sequences and escape Loguru markup tags before passing strings to the logging functions.
import re
# Regex to match and strip ANSI escape sequences
ANSI_ESCAPE_RE = re.compile(r'\x1b\[[0-9;]*[a-zA-Z]')
def safe_log_format(input_data: str, max_len: int = 256) -> str:
if not input_data:
return ''
# Truncate to limit backtracking complexity
truncated = input_data[:max_len]
# Strip ANSI codes
no_ansi = ANSI_ESCAPE_RE.sub('', truncated)
# Escape Loguru tags to prevent parser execution
return no_ansi.replace('<', '\<').replace('>', '\>')3. Log Audit & IoC Verification Commands
Use the following commands to check the installed version of Loguru and audit your codebase for vulnerable patterns.
# Check the installed Loguru version in the current environment
python3 -c "
try:
import loguru
print(f'[INFO] Installed Loguru version: {loguru.__version__}')
if loguru.__version__ == '0.7.3':
print('[WARNING] Vulnerable version 0.7.3 detected. Action required.')
else:
print('[OK] Version is safe.')
except ImportError:
print('[INFO] Loguru is not installed.')
"
# Scan requirements files for the vulnerable version
grep -r 'loguru==0.7.3' .Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2026-120217) exists within the ANSI Color-Markup Parser component of Delgan Loguru, specifically in the AnsiParser.feed function located in loguru/_colorizer.py. The root cause is an inefficient regular expression pattern used to parse ANSI color codes and markup tags. When processing specifically crafted input strings, the regular expression engine suffers from catastrophic backtracking (CWE-1333), leading to resource exhaustion (CWE-400).
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability remotely if the target application logs untrusted user input (such as HTTP request headers, query parameters, or API payloads) using Loguru. By sending a payload containing a carefully structured sequence of ANSI escape characters or repetitive markup patterns, the attacker forces the AnsiParser.feed function to evaluate an exponential number of states. This blocks the execution thread, spikes CPU usage to 100% on the affected core, and effectively denies service to legitimate users.
3. Infrastructure & Business Impact
Since Loguru is a highly popular logging framework in the Python ecosystem (frequently integrated with FastAPI, Flask, and Celery), this vulnerability poses a significant threat to application availability. A successful ReDoS attack can lead to complete service degradation, API timeouts, and cascading failures in containerized environments (e.g., Kubernetes liveness probe failures leading to continuous pod restarts), impacting business operations and SLA commitments.
Official Vendor Advisories & References
A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file loguru/_colorizer.py of the component ANSI Color-Markup Parser. Performing a manipulation results in inefficient regular expression complexity. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Frequently Asked SecOps Questions (CVE-2026-120217)
FAQQ1. How critical is CVE-2026-120217 and is it actively exploited in the wild?
CVE-2026-120217 is rated CVSS 4.3 (MEDIUM) with a 30-day EPSS exploitation probability of 0.3%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-120217?
Primary impacted vendors include delgan across loguru. Scope summary: Delgan Loguru version 0.7.3 (specifically the AnsiParser.feed function in loguru/_colorizer.py)
Q3. What temporary mitigations or workarounds exist for CVE-2026-120217 before patching?
[Mitigation] Upgrade to a non-vulnerable version of Loguru, or sanitize and restrict the length of untrusted inputs before passing them to the logger Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-120217
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (delgan)
View Category →Aedes MQTT Broker Denial of Service (DoS) via Excessive Topic Depth (CVE-2026-63341)
[Affected Scope] All Node.js environments running Aedes MQTT broker versions prior to 1.1.1.
GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
Google Brotli Decoder Remote Code Execution (RCE) and Memory Corruption Vulnerability (CVE-2026-111497)
[Affected Scope] All web servers, browsers, Node.js environments, and backend applications using Google Brotli library versions 1.0.3 through 1.2.0
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.